← Adversaries
File · Equation · Unknown · mitre-attack · refreshed 2026-10-06
Equation
attack rose · 4 techniques across 2 tactics
Last 30 days
last seen 14 d agodispatches3
victims0
CVEs seen2
What changed
ledger · newest first- —16 d agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
mitre-attackEquation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives.
Kill chain
MITRE ATT&CK Enterprise · tap a technique4 techniques · 2 of 15 tactics
Stealth
3 techniquesDiscovery
1 technique
select a technique
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
2 sourcesTrack Equation on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.