- Category
- State · Attributed to a state or working for one.
- Origin
- United States(high confidence)
- Sponsor
- State-sponsored, believed to be tied to the NSA’s Tailored Access Operations unit
- Agency named
- GCHQ, MSS, Ministry of State Security, NSA
- Motivation
- Espionage; Information theft and espionage; Sabotage and destruction
- Seen
- 2001–2026
- Status
- Active
- ATT&CK
- G0020 · 4 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0063 · equation
United StatesWhat it is
Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0020
- Qihoo 360
- APT-C-40
- Operations
- Operation Triangulation
- Other names
- Equation Group, Bvp47 / Equation, EQGRP, Housefly, NSA TAO, Platinum Colony, Remsec, Tilded Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTUnited States
- MISP Galaxy (CFR tagging)United States
- ThreatActor.info (Malpedia et al.)United States
Chinese and Russian sources
- Qihoo 360United States
- 360 Digital Security Group · 2022-02360 ties APT-C-40 to the NSA TAO unit and to the 2022 Northwestern Polytechnical University intrusion; names tools including NOPEN, Validator, QUANTUM, Second Date, Acid Fox.United States · high (claimant)
- National Computer Virus Emergency Response Center (CVERC) · 2022-09CVERC and 360 joint reports on the Northwestern Polytechnical University intrusion (2022) and later the Harbin Asian Winter Games (2025) named NSA TAO and, in 2025, three named NSA employees.United States · high (claimant)
- Pangu Lab · 2022-02Pangu Lab's Bvp47 report attributes the Linux backdoor to Equation Group and the NSA.United States · high (claimant)
- Kaspersky · 2015-02Original discovery and naming.United States · Kaspersky does not name a state; linkage to NSA rests on Shadow Brokers leaks and Snowden documents
- Russian Federal Security Service (FSB) · 2023-06iOS zero-click campaign against Russian diplomats and Kaspersky staff. Threat actor behind it has no agreed name; Malpedia files it under Equation Group's operations.United States · FSB statement; Kaspersky, which found the campaign, made no attribution; Apple denied cooperation
Targets
- Countries
- Afghanistan, Algeria, Austria, Bangladesh, Belgium, Bolivia, Bosnia and Herzegovina, Botswana, Brazil, Chile, China, Cyprus, Ecuador, Egypt, Finland, France, Gabon, Germany, Greece, Hong Kong, Hungary, India, Iran, Iraq, Israel, Italy, Japan, Jordan, Kazakhstan, Kenya, Lebanon, Libya, Malaysia, Mali, Mexico, Netherlands, Nicaragua, Nigeria, Norway, Pakistan, Palestine, Philippines, Poland, Qatar, Romania, Russia, Saudi Arabia, Singapore, Somalia, South Africa, South Korea, Spain, Sudan, Sweden, Switzerland, Syria, Thailand, Türkiye, United Arab Emirates, United Kingdom, United States, Venezuela, Yemen
- Sectors
- Aerospace, Defense, Education, Energy, Government, Media, Military, Oil and gas, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- Apple iOS 0days
- Bvp47
- Cyber Eye RAT
- CyberGate
- DanderSpritz
- DarkPulsar
- DoubleFantasy
- DoubleFeature
- DoublePulsar
- Duqu
- EquationDrug
- EquationLaser
- Fanny
- Flame
- GROK
- Gauss
- Grayfish
- Lambert
- OddJob
- Regin
- RemSec
- Remote Utilities
- RemoteCMD
- RemotePC
- TripleFantasy
- UNITEDRAKE
- Xploit
- many others
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net