{
  "family": "equationdrug",
  "sample_count": 25,
  "category": "trojan",
  "description": "Trojan:Win32/EquationDrug is a highly complex, extremely sophisticated cyber-espionage platform attributed to the 'Equation Group' (widely believed by the intelligence community to be the NSA's Tailored Access Operations (TAO)). Discovered by Kaspersky in 2015, EquationDrug acts as a central plugin framework for delivering a vast array of highly classified exploits and data theft modules.<br><br><b>Understanding EquationDrug</b><br>To a standard user, EquationDrug is entirely invisible. For nation-state threat hunters, EquationDrug is a masterpiece of software engineering. It is not a simple trojan; it is a sprawling, modular operating system that runs secretly *within* Windows. It is designed for surgical precision against high-value targets (telecoms, military, nanotechnology) and possesses capabilities rarely seen outside of state-sponsored actors, including firmware reprogramming and cryptographically secured virtual file systems.<br><br><b>Execution, Rootkits, and Espionage Modules</b><br>EquationDrug is deployed via zero-day exploits or physical interdiction (supply chain attacks) (`T1195`). Upon execution, it deploys a deeply embedded kernel-mode rootkit (`T1014`) to hide its presence. It creates a hidden, encrypted Virtual File System (VFS) stored within the Windows registry (`T1112`) to store its stolen data and plugins securely. The framework dynamically loads modules for specific tasks: keystroke logging, intercepting network traffic (`T1056`), stealing cryptographic keys, and—most famously—reprogramming hard drive firmware to create persistence that survives full disk formatting (`T1542`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, undetectable compromise of a high-value network. EquationDrug is designed to evade standard EDR and AV. Detection requires advanced memory forensics and analysis of raw disk anomalies. Indicators include highly obfuscated, undocumented registry keys containing massive binary blobs (the VFS), and anomalous kernel driver loading behavior. Eradication of EquationDrug, due to its firmware capabilities, often requires the physical destruction of the infected hard drives.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056",
    "T1542",
    "T1195",
    "T1112",
    "T1014"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1542",
      "name": "Pre-OS Boot",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1195",
      "name": "Supply Chain Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Due to the extreme sophistication of the threat actor (APT), immediately involve national CERTs or specialized incident response firms.",
    "Do NOT attempt to clean the machine. Unplug the physical network cable to sever the C2 connection, but leave the machine powered on.",
    "Capture a full physical memory image (RAM dump) for forensic analysis of the kernel rootkit and the decrypted Virtual File System.",
    "Because EquationDrug is known to re-flash hard drive firmware, standard OS wiping is insufficient. The physical hard drive must be securely destroyed."
  ],
  "what_to_avoid": [
    "Do not alert the threat actor by running aggressive AV scans; they may trigger self-destruct mechanisms to destroy forensic evidence.",
    "Avoid assuming a reformat fixes the issue; EquationGroup tools survive OS reinstalls via firmware modifications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}