Equation

Threat Actor
10 incidents First seen 2025-12-25 Last seen 2026-09-02
Overview

Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190 5 techniques in ATT&CK since 2017-05-31 updated 2026-07-31 · v1.2
Activity by month (incidents)
2025-122026-09
Sectors targeted
energy · 3technology · 3education · 1finance · 1government · 1manufacturing · 1media · 1
Countries targeted
BO · 2BR · 2CA · 2CN · 2IR · 2RU · 2AO · 1AR · 1AT · 1AU · 1BD · 1BE · 1
Origin
CA · 2US · 2AF · 1AO · 1AR · 1AU · 1
Kinds of incident
Exploited Vulnerability · 3Industry & Policy · 3Malware & Botnets · 2Phishing & Social Engineering · 1Vulnerability Disclosure · 1
Techniques seen in incidents
Phishing · 4T1588.001 - Malware · 4Privilege Escalation · 3T1059.006 - Python · 3T1592.002 - Software · 3Exfiltration · 2Lateral Movement · 2Ransomware · 2Reconnaissance · 2Sabotage · 2T1059.001 - PowerShell · 2T1588.005 - Exploits · 2Botnet · 1Impersonation · 1
Related malware
Stuxnet · 2Carbon · 1Duqu · 1Flame · 1Flamer · 1Havoc · 1PowerShower · 1
Related CVEs
CVE-2017-11882 · 3CVE-2018-0802 · 3CVE-2017-0199 · 2CVE-2019-13272 · 2CVE-2021-22555 · 2CVE-2022-0847 · 2CVE-2023-32233 · 2CVE-2023-36884 · 2CVE-2023-38831 · 2CVE-2023-46604 · 2
ATT&CK techniques by tactic (5)
persistence T1542.002 Component Firmware
discovery T1120 Peripheral Device Discovery
stealth T1480.001 Environmental Keying T1542.002 Component Firmware T1564.005 Hidden File System
Incident timeline
2026-09-02
AI’s Vulnerability Surge May Be More Manageable Than First Feared
Dark Reading
2026-08-26
Kaspersky The Hacker News Talos Intelligence
2026-06-25
Upwind Security Brings AI Visibility to the Endpoint, Unifying Cloud and Device Security
HackRead
2026-05-22
Kaspersky Kaspersky
2026-05-18
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations
The Hacker News
2026-05-07
Exploits and vulnerabilities in Q1 2026
Kaspersky
2026-04-25
Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software
The Hacker News
2026-03-12
Attackers Don't Just Send Phishing Emails. They Weaponize Your SOC's Workload
The Hacker News
2026-02-23
More Than Dashboards: AI Decisions Must Be Provable
Dark Reading
2025-12-25
Threat landscape for industrial automation systems in Q3 2025
Kaspersky