A brief explanation on the Equation Group and one of their malware: GRAYFISH

1. THE EQUATION
GROUP -
GRAYFISH

2. “
The Equation Group is probably one of the
most sophisticated cyber attack groups in
the world; and they are the most
advanced threat actor we have seen.
- Kaspersky Lab

3. What is
THE EQUATION GROUP
◦ Highly sophisticated threat actor
◦ Only targets specific victims
◦ Multiple malware platforms
◦ High technical expertise and resources
◦ Create some of the most advanced threat

4. TOOLS AND MALWARE
Fanny
◦ Maps air-gapped
systems using USBs
and Stuxnet exploit
Triplefantasy
◦ Full-featured backdoor
◦ Targets validator
Equationdrug
◦ Modular plugin system
◦ Dynamically loaded by
the attackers
Grayfish
◦ Resides completely in
the HD registry
◦ Use a bootkit to gain
execution at OS startup
Data Access
◦ Knowledge of several
software and hardware
manufacturer designs
C & C Servers
◦ Issue commands to
malware, and collect
stolen data
◦ More than 400!

5. “
Equation Group are the ones with the
coolest toys, every now and then they
share them with the Stuxnet group and
the Flame group, but they are originally
available only to the Equation Group
people. They are definitely the masters,
giving the others bread crumbs.
- Costin Raiu (director of Kaspersky Lab's global
research and analysis team)

6. GRAYFISH
 Flashes the firmware of HDs inserting
a ‘pill’
 Hijack the boot sequence of the
operating system
 Install a Virtual File System in the
registry of the hard drive
 Malware execute codes and steals
information

7. GRAYFISH: THE ARCHITECTURE
BBSVC service
(polymorfic-loader)
Shellcode from
registry
Exploit for Elby
driver + loader (Kernel
mode)
Load platform kernel
mode for orchetrator
(fvexpy.sys)
Load user-mode part
from registry
(mpdkg32/64.dll)
Start payloads
(registry)
X1000 SHA-256
+ AES
Infected VBR
Encrypted container
file + Pill

8. Non Air Gapped
Attack Vectors:
• Cookie spoofing
• Spear phishing
• CSRF
• XSS
• Java exploits
ATTACK STRATEGIES
Air Gapped
Attack Vectors:
• Physical supports
• Stuxnet hack
• Fanny
INITIAL EXPLOIT
• Escalation of
privilege to
install
TrypleFantasy
INFECTION TRIPLEFANTASY
• Validate
victims,
confirm
interest
UPGRADE GRAYFISH
• Full-featured
espionage
platform

9. WHY SO DANGEROUS?
“After infection, the computer is not run by itself anymore: it is GRAYFISH
that runs it step by step, making the necessary changes on the fly.”
-Kaspersky Lab
Invisible
Not possible to
be detected by
standard
antivirus
Persistent
Reinstalling
operating
system or
updating the
HD firmware
does nothing
Design
Equation group
got a hold of so
many major
designs

10. HOW TO DETECT GRAYFISH?
Very difficult:
• Malware is hidden in
service area of the HD
• Specific circumstances
can trigger GRAYFISH
self-destruction.

11. HOW CAN WE PREVENT IT?
Attempts to tamper the
firmware will fail verification
BUT: firmware was not
designed with security in mind
Manufactures must sign
firmware

12. Thanks!
ANY QUESTIONS?
You can find me at
antichi.leonardo@gmail.com

13. REFERENCES
● https://securelist.com/files/2015/02/Equation_group_questions
_and_answers.pdf
● https://securelist.com/a-fanny-equation-i-am-your-father-
stuxnet/68787/
● http://rt.com/usa/239933-equation-group-nsa-links-backsnarf/
● http://www.wired.com/2015/02/nsa-firmware-hacking/
● https://www.schneier.com/blog/archives/2015/02/the_equation
_gr.html
● http://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation
_group/
● http://www.wired.com/2015/02/kapersky-discovers-equation-
group/
● https://leaksource.files.wordpress.com/2013/12/nsa-ant-
iratemonk.jpg
● https://arstechnica.com/information-technology/2015/02/how-
omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-
at-last/
● https://www.fedscoop.com/the-kaspersky-equation/
● https://www.kaspersky.com/about/press-releases/2015_equation-
group-the-crown-creator-of-cyber-espionage
● https://www.pcworld.com/article/2884952/equation-cyberspies-use-
unrivaled-nsastyle-techniques-to-hit-iran-russia.html

14. DATA DEEPENING
Additional information
Q&A

15. 0
5
10
15
20
25
30
35
40
45
50
Monday Tuesday Wednesday Thursday Friday Saturday Sunday
Equation Group Activity (Samples Count)
DATA

16. DATA
Malicious PHP script injected into hacked discussion forums
MAIN TARGETS:
• Islamic Jihadist discussion forums
• advertisements on popular websites in the Middle East
NOT INFECT: 1. Jordan 2. Turkey 3. Egypt

17. GRAYFISH: HOW IT WORKS?
GrayFish Re-flashes
Hard Drive Firmware
Firmware contains
infected Virtual Boot
Record (VBR)
OS uses infected VBR
when it boots
Creates hidden Virtual
File System in HD
registry to store data
Installs malicious
modules on machine
Steals and stores data
Hidden Virtual File
System
User removes malicious
modules

18. GRAYFISH
Boot steps