Equation Group: Capabilities, the Shadow Brokers Leaks and EternalBlue Lessons

Equation Group is the name Kaspersky gave in 2015 to one of the most capable espionage operations ever documented, and the tools later leaked under its name gave criminals and states the exploit that powered WannaCry and NotPetya. Its story matters to defenders for two reasons: it showed what a top-tier actor can do below the operating system, in disk firmware and hidden storage, and the Shadow Brokers leaks of 2017 showed what happens when such capabilities escape. This profile covers what is known about the group from primary research, how its tooling worked at a level useful for defence, the EternalBlue lineage, and what to check today. It is written for threat intelligence, vulnerability management and security architecture teams. It names no individuals and relies on vendor primary research and government statements.

Key takeaways

• A long-running, highly resourced actor. Kaspersky's 2015 report traces Equation command and control to 2001 and possibly 1996, with thousands or perhaps tens of thousands of victims.
• Persistence below the operating system. A module reprogrammed the firmware of hard drives from over a dozen manufacturers, which ATT&CK records as T1542.002 Component Firmware.
• Air gaps were a target, not a barrier. The Fanny worm used USB drives and an LNK exploit to map isolated networks, two zero-days it used before Stuxnet did.
• Leaked exploits became mass-casualty malware. Microsoft's analysis of the April 2017 Shadow Brokers release maps EternalBlue to MS17-010; WannaCry and NotPetya, attributed by the US and partners to North Korea and the Russian military, both used it.
• The defensive lesson is patching and legacy protocols. MS17-010 was released a month before the leak; organisations still running SMBv1 or unpatched hosts were the ones hit.

What it is

Kaspersky's Global Research and Analysis Team (GReAT) published its Equation report on 16 February 2015, describing the group as probably one of the most sophisticated cyber attack groups in the world. The name reflects the group's preference for sophisticated encryption. Kaspersky did not name a sponsoring state. It reported that Equation had interacted with the groups behind Stuxnet and Flame and often had access to exploits before them. MITRE ATT&CK lists the group as Equation (G0020).

How it works

The detail below is at the level defenders need to understand risk and detection limits, not to reproduce anything. ATT&CK v20 records four techniques for Equation, and Kaspersky's report adds the delivery and propagation methods.

The Shadow Brokers leaks and EternalBlue

In April 2017 a group calling itself the Shadow Brokers published a large set of exploits that it presented as Equation Group tooling. Public reporting has linked the material to Equation, but no government has formally confirmed its origin, and Microsoft's analysis addressed the exploits, not the source. Microsoft's Security Response Center reported on 15 April 2017 that most exploits were already patched in supported products:

MS17-010, released on 14 March 2017, fixed CVE-2017-0143 to CVE-2017-0148 in the SMBv1 server, flaws an unauthenticated attacker could exploit with a crafted packet. All of these CVEs are in the CISA KEV catalogue with known ransomware use.

From leak to WannaCry and NotPetya

In May 2017 WannaCry spread to hundreds of thousands of computers in more than 150 countries; on 19 December 2017 the US attributed it to North Korea, with the UK, Australia, Canada, New Zealand and Japan. In June 2017 NotPetya caused what the US called billions of dollars in damage; on 15 February 2018 the US attributed it to the Russian military. MITRE ATT&CK records both WannaCry (S0366) and NotPetya (S0368) using EternalBlue for T1210 Exploitation of Remote Services, with NotPetya also using EternalRomance. Neither was an Equation operation. They show how exploits leaked from one actor are reused by others.

Why it matters

• Exploits leak: Any capability, however closely held, can escape. Patch prioritisation should assume a high-impact flaw may become public suddenly. The Zero-Day and Exploited Vulnerabilities Guide covers how to respond.
• Legacy protocols stay dangerous: EternalBlue still matters wherever SMBv1 survives, often on old medical, industrial or embedded systems. See the SMB Protocol Security and Signing Guide.
• Firmware is part of the attack surface: Equation's disk firmware module showed that a clean OS reinstall does not guarantee a clean machine. See the Firmware and Boot Security Guide.
• Detection has limits: Environmental keying and hidden storage mean a top-tier implant may never show itself to a sandbox or a disk scan. Threat models for high-value targets should assume some compromises are found only through behaviour, memory forensics or external intelligence, and plan incident response accordingly.
• Isolation needs controls: Fanny's air-gap mapping shows that isolated networks need removable media control and monitoring, not just the absence of a network link.

Detection and measurement

Firmware implants and hidden file systems are hard to detect directly, so focus on what you can measure: the exposure that leaked exploits use and the integrity of your platform.

• SMBv1 presence: Inventory hosts with the SMB1.0/CIFS File Sharing Support feature installed and any SMBv1 traffic on the network; the target is zero outside documented exceptions.
• Patch status: Measure coverage of MS17-010 and successors on every Windows host, including unmanaged and legacy devices.
• Exposure: Confirm TCP 445 is not reachable from the internet and is restricted between network zones.
• Exploit attempts: Use IDS signatures for SMB exploitation and alert on lateral SMB connections from workstations to many hosts.
• Removable media: Log USB device connections in sensitive and isolated environments.

Useful measures: percentage of hosts with SMBv1 disabled; days to patch KEV-listed remote code execution flaws; number of hosts exposing TCP 445 externally (target zero); percentage of hardware purchased through trusted channels with firmware integrity verification; and percentage of isolated systems with USB controls enforced.

Framework mapping

Common misconceptions

• "Equation Group ran WannaCry." It did not. Governments attributed WannaCry to North Korea and NotPetya to the Russian military. The link is reuse of leaked exploits.
• "EternalBlue was a zero-day when it hit." Microsoft released MS17-010 on 14 March 2017, before the April leak and the May outbreak. Victims were unpatched.
• "Only spies need to worry about firmware implants." Nation-state methods tend to filter down. Hardware provenance and firmware integrity are now mainstream controls.
• "Air-gapped means safe." Fanny was built to cross air gaps on USB drives.
• "This is history." SMBv1 and unpatched Windows still exist in many estates, especially in operational technology and healthcare, and EternalBlue scans remain common.

Related concepts

Equation sits at the top of the nation-state espionage spectrum. For legacy operating systems that cannot take MS17-010, see the Operating System End of Life and Extended Support Guide. For patch prioritisation, see the CISA KEV Catalogue Guide and Patch Management Guide. For hardware provenance, see the Hardware and Firmware SBOM Guide. NotPetya is a reminder that a trusted update channel can become the delivery route, which is covered in the Top 10 Supply Chain Attacks.

Closing the EternalBlue gap

1. Discover: Scan for SMBv1 support and missing MS17-010 across all subnets, including OT and medical device networks.
2. Patch: Apply current cumulative updates; for systems that cannot be patched, isolate them and plan replacement.
3. Disable SMBv1: Remove the SMB1.0/CIFS File Sharing Support feature in pilot groups first, watch for broken legacy printers, scanners or applications, then roll out widely. Microsoft documents re-enabling the feature as the rollback.
4. Restrict: Block TCP 445 at the internet edge and between zones that do not need file sharing.
5. Verify: Re-scan monthly and alert on any reappearance of SMBv1 traffic.

Small organisations can usually disable SMBv1 everywhere quickly, since modern Windows does not need it. Large estates with legacy and OT systems need an exceptions register with compensating segmentation.

Practitioner checklist

• Inventory every host that supports SMBv1 and every system missing MS17-010.
• Disable SMBv1 through pilot groups, keeping a documented rollback for legacy dependencies.
• Block TCP 445 from the internet and restrict it between network zones.
• Track KEV-listed remote code execution flaws to a fixed remediation deadline.
• Buy hardware through trusted channels and verify firmware integrity where the platform supports it.
• Enforce USB and removable media controls on isolated and sensitive systems.
• Treat physical media received from outside the organisation as untrusted.
• Plan for a sudden public exploit release: know who decides on emergency patching and isolation.

Standards and references

• Kaspersky GReAT: Equation: The Death Star of Malware Galaxy
• Microsoft: Security Bulletin MS17-010
• Microsoft Security Response Center: Protecting customers and evaluating risk
• The White House: Press briefing on the attribution of the WannaCry malware attack
• The White House: Statement on NotPetya attribution
• MITRE ATT&CK: Equation (G0020)
• MITRE ATT&CK: Component Firmware
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: SMB Protocol Security and Signing Guide · Firmware and Boot Security Guide · Zero-Day and Exploited Vulnerabilities Guide · Lazarus Group Threat Actor Profile