Equation Group: The Kaspersky Report a Decade(ish) Later
Revisiting the bombshell report on the NSA’s elite hacking unit
Foreword
Take everything you read here with a large grain of salt. I am not a cybersecurity professional. I’m not an information security professional. Actually I’m not a professional anything at the moment. I’m a student and a hobbyist. I’m reviewing this report out of sheer respect for the threat actors who have the technical expertise to accomplish feats such as these. I also think it will serve as a nice benchmark for my own skill. Maybe I’ll come back in a year and understand this document in new and deeper ways. The fact that this report is 11 years old blows my freaking mind. If they were capable of this back in 2015, imagine what they’re capable of now.
Disclaimer
Portions of this article were drafted with help from Claude (Anthropic’s AI assistant). I used it during my initial research and to summarize and reword some sections of Kaspersky’s report, then reviewed and edited everything myself. The analysis, framing, and any opinions (including any mistakes) are my own.
Context of the Report
On June 20, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) blacklisted Kaspersky, a Russian-based cybersecurity firm, from operating in the U.S. The official release states national security as the chief reason for the action. The company falls under Russian jurisdiction. The release outlines several justifications as to why this is problematic for U.S. national security:
- Kaspersky must comply with requests for information from the Russian Government.
- Kaspersky has admin access to customer data. U.S. employees could transfer this data to Russia.
- Kaspersky has the ability to weaponize its AV software against US cyber infrastructure.
- Kaspersky software may be utilized in third-party products, which may jeopardize the security of those products.
Kaspersky unsuccessfully challenged the BIS determination(1). The cybersecurity company has been in the U.S. Government’s crosshairs since at least 2017.
On October 5th, 2017, the Wall Street Journal reported that in 2015, an NSA contractor’s OPSEC failure enabled Russian hackers to acquire sophisticated NSA exploits. According to the WSJ, the contractor’s use of Kaspersky’s antivirus software is what led to the digital theft.
According to Kaspersky, this incident occurred in 2014 when their antivirus software had simply detected a ZIP file of samples and source code and auto-uploaded it via the Kaspersky Security Network. As a result of their own internal investigation, Kaspersky believes that the contractor’s system was unsecure long before their own AV system had picked up the malware signatures. The report detailing the full investigation is well worth a read.(2)(3)
Hollywood version? Maybe the NSA contractor’s accidental disclosure wasn’t so accidental.
Kaspersky’s report was released in 2015. What a year for the NSA. Given the timing, it’s hard not to wonder whether the Equation Group report and the Kaspersky-Pho incident are connected. Within their report, Kaspersky credits the discovery to unrelated Regin research. Draw your own conclusions. Hopefully that was enough context to satiate the extra curious. Now back to our regularly scheduled programming.
Equation Group: Questions and Answers: A skid’s review
This report details some of the exploits developed and utilized by the so-called Equation group (named because of their use of encryption algorithms and obfuscation). “The Equation group is a highly sophisticated threat actor that has been engaged in multiple CNE (computer network exploitation) operations dating back to 2001, and perhaps as early as 1996.” Kaspersky stops short of naming the NSA, but the keyword artifacts left in the malware led outside analysts to widely attribute Equation group to the NSA’s Tailored Access Operations (TAO), the digital special forces of US intelligence, if you will. Before his infamous leak of classified documents, Edward Snowden allegedly aced the TAO’s entrance exam (using answers that were in the trove of documents he exfiltrated) and was offered a position but turned it down because he wasn’t satisfied with the salary*. But enough about Snowden.
*It is worth mentioning that the House Intelligence Committee report containing this information has been heavily disputed. Whether it’s factual or a carefully crafted morsel of Uncle Sam propaganda is up for you to decide.
Get c4v’s stories in your inbox
Join Medium for free to get updates from this writer.
I’ll be detailing/analyzing what I believe to be the 3 most sophisticated capabilities revealed in the report. The goal is to dumb everything down in the hopes that I can better understand it. Here goes nothing.
“The most sophisticated thing about the Equation group”
In its report, Kaspersky explicitly states that, “there is one aspect of the Equation group’s attack technologies that exceeds anything we have ever seen before.” That aspect is “the ability to infect the hard drive firmware.” They attack the drive itself, rewriting the firmware that runs on the controller board of the physical disk (plugin ID 80AA in their internal table). Once that firmware is reflashed, the implant survives a full format and a clean OS reinstall. The plugin even carves out a hidden storage area in the drive’s service sectors, an invisible vault that no file system or antivirus would ever see.
The module reflashes drives from Western Digital, Seagate, Samsung, Toshiba, Hitachi, Micron, and even oddballs like OCZ and Mushkin. To this day, that is an incredibly large percentage of the hard drive industry. Each vendor’s firmware is a proprietary black box with no public manual, so to pull this off, somebody either reverse-engineered a dozen different vendors’ firmware from scratch or simply had the source code to begin with (knowing Uncle Sam I tend to lean towards this theory). Regardless, an impressive feat of engineering. Kaspersky only found this on a handful of victims. You don’t spend a capability like that on just anyone.
GrayFish: malware that boots your computer for you
GrayFish is the crown jewel of the platforms. Developed somewhere between 2008 and 2013, what makes GrayFish so special is what it refuses to do: touch the disk. There are no malicious executables sitting in a folder waiting to be found. The modules and the stolen data all live encrypted inside the Windows registry and get decrypted and executed on the fly. To even get going, GrayFish infects the boot record and hijacks the startup sequence from the very first instant, so after infection your computer isn’t really booting itself anymore; GrayFish is walking it through every stage and patching pieces into place as it goes. It then runs a four-or-five-stage decryption chain to claw its way into the running OS, and if any single stage trips, the whole platform self-destructs rather than risk being caught half-undressed. Wild.
Fanny: the worm that walked across the air gap
Fanny is a worm from 2008 that spread through the Middle East and Asia, relying on two zero-day exploits (an LNK vulnerability and a privilege-escalation bug). The world would later come to know these exploits from Stuxnet. Fanny used both of them before Stuxnet did. When the same rare zero-days surface in two different worms at roughly the same moment, it is very likely that the people writing them are either the same team or working very closely together. This is one of the threads tying the Equation Group to the Stuxnet operation.
Fanny’s purpose was mapping networks that aren’t connected to the internet at all. Air-gapped machines are supposed to be unreachable by definition, and Fanny got around that by using a USB stick. When it infected a thumb drive it created a hidden storage area on it; plug that stick into an air-gapped computer and Fanny would quietly stash the machine’s system info into the hidden area. Plug that same stick back into an internet-connected box and Fanny would scoop that data out and ship it to the C2. It even ran in reverse; operators could leave commands in the hidden area for the isolated machine to pick up and execute. A human courier with a USB stick, unknowingly (…or knowingly?) ferrying intelligence back and forth across a gap that was meant to be impassable!
Conclusion
I’ve only scratched the surface of these 3 capabilities and the whole report as a whole. The more time I spend learning in this field, the more I realize I know nothing! Thankfully I love to learn and cybersecurity is a field of infinite learning. I’ve recently set up my own air-gapped FlareVM workspace and I’m looking forward to detonating and studying the behavior of different families of malware. Hopefully I can come back to this post in a year or so and have a few aha! moments. Until next time.
Sources
- Federal Register :: Final Determination: Case No. ICTS-2021–002, Kaspersky Lab, Inc.
- NSA employee pleads guilty to taking classified information home — CyberScoop
- U.S. v. Nghia Hoang Pho
Not directly used but worth the read:
