Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Equation Group · Nation-state · assessed origin United States · misp-galaxy · refreshed 2026-10-06

Equation Group

  • Tilded Team
  • EQGRP
  • G0020

state sponsor · United States

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE7 new CVEs: CVE-2010-2568, CVE-2012-0159, CVE-2012-1723, CVE-2012-4681, CVE-2013-3894, CVE-2013-3918 +1 more

Analyst brief

misp-galaxy

The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and Flame

Observed targets (as stated by the sources)

15 countries · 2 sectors
IranAfghanistanSyriaYemenKenyaRussiaIndiaMaliAlgeriaUnited KingdomPakistanChinaLebanonUnited Arab EmiratesLibyaAssessed origin: United States

assessed origin · United Statesobserved targets · 15

countries · 15

  • Iran
  • Afghanistan
  • Syria
  • Yemen
  • Kenya
  • Russia
  • India
  • Mali
  • Algeria
  • United Kingdom
  • Pakistan
  • China
  • Lebanon
  • United Arab Emirates
  • Libya

sectors · 2

  • Government
  • Military

as stated by MISP galaxy / ransomware.live — not inferred

CVEs Equation Group is cited as exploiting

none on KEV
  1. CVE-2017-00052026-10-17
    1. “Equation Group’s EpMe exploit, existing since at least 2013, is the original exploit for the vulnerability later labeled CVE-2017-0005.”

      cited as exploiting · source: research.checkpoint.com ↗ · 2026-10-17

  2. CVE-2012-46812026-10-17
    1. “CVE-2012-4681 (Java).”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

  3. CVE-2012-17232026-10-17
    1. “CVE-2012-1723 (Java).”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

  4. CVE-2013-39182026-10-17
    1. “An interesting case is the use of CVE-2013-3918, which was originally used by the APTgroup behind the 2009 Aurora attack. The EQUATION group captured their exploit and repurposed it to target government users in Afghanistan.”

      cited as exploiting · source: media.kasperskycontenthub.com ↗ · 2026-10-17

  5. CVE-2010-25682026-10-17
    1. “LNK vulnerability as used by Stuxnet. (CVE-2010-2568).”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

  6. CVE-2013-38942026-10-17
    1. “TTF exploit fixed with MS13-081 (possibly CVE-2013-3894).”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

  7. CVE-2012-01592026-10-17
    1. “TTF exploit fixed with MS12-034 (possibly CVE-2012-0159).”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2015Equation Group: Questions And AnswersKaspersky ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.en.wikipedia.org/wiki/Equation_Group
  2. 2.cfr.org/interactive/cyber-operations/equation-group
  3. 3.arstechnica.com/information-technology/2015/02/how-omnipotent-hackers-…
  4. 4.dropbox.com/s/buxkfotx1kei0ce/Whitepaper%20Shadow%20Broker%20-%20E…
  5. 5.en.wikipedia.org/wiki/Stuxnet
  6. 6.media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_…
  7. 7.attack.mitre.org/groups/G0020

Track Equation Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.