GRAYFISH is the most modern and sophisticated malware implant from the Equation group. It is designed to provide an effective (almost “invisible”) persistence mechanism, hidden storage and malicious command execution inside the Windows operating system.

1. Equation group
and GrayFish

2. Equation group
• “The Equation Group is probably one of the most
sophisticated cyber-attack groups in the world; and they
are the most advanced threat actor we have seen” -
Kaspersky Lab
• Operating since 2001
• Highly sophisticated threat actor​
• Multiple malware platforms
• High technical expertise and resources​

3. What is GrayFish Attack?
Victim shows
interest
Hacker asks to
visit a website
Victim visits
website
Hacker got access
over complete
system

4. OS uses infected VBR
when it boots
Firmware contains
infected virtual boot
record
Hidden virtual file
system
Installs malicious
modules on machine
How GrayFish
works?
GrayFish Reflashes Hard
Drive Firmware
Creates hidden virtual
system in HD registry to
store data
steals and
stores data

5. Web-based exploit
Infection Lifecycle
DoubleFantasy
GrayFish
Full featured
espionage
platform
Validates victim confirms
they are interested
Installer uses escalation of privilege
exploits to install double fantasy
payload
Infectio
n
Upgrade

6. How to
Prevent?
When a firmware has this signature attached to it, a device will
validate the firmware before accepting to install it. If the device
detects that the firmware integrity is compromised, the
firmware upgrade will be rejected.
Use signed firmware
Get a new hard drive
If your system is infected with GrayFish then reinstalling
operating system or updating the HD firmware does nothing
only possible way to get rid is to get new hard drive.

7. How did Kaspersky find
GrayFish?
• Kaspersky set up a server in
middle east that does
everything possible to look
like a target called the
magnet of treats, while
looking for similar type of
malware called Regin,
Kaspersky found several
different kinds of equation
group malware

8. Real life
Example
• Code Artifacts from the malware show several different
names of operations such as straitacid, strait​shooter,
DrinkParsley, Barksnarf, etc and a single line username
"rmgree5"
• Evidence by NSA- Product page from ANT product
catalog for NSA mentions a program called IRATEMONK
which "provides software application persistence on
computers by implanting hard drive firmware to gain
access by MBR substitution". This description matches
functionality of Grayfish.

9. Thank You