apt

Equation Group

dormant · last signal 2y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

EquationEQGRPTilded team (Stuxnet/Duqu-adjacent)

Attribution

United States — assessed NSA-linked (high confidence on capability, circumstantial on sponsor); included for MENA targeting via Stuxnet-class operations against Iran

Origin

United States

First seen

2001

Last active

2015

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Iran (Natanz), broader Middle East

Sectors

Nuclear/critical infrastructure, government, telecom

MITRE ATT&CK

G0020 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iran (Natanz), broader Middle East (Nuclear/critical infrastructure, government, telecom sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Updated MATA attacks industrial companies in Eastern EuropereportORKL2023-10-18

Uses

Environmental KeyingtechniqueATT&CK mapping
Component FirmwaretechniqueATT&CK mapping
Hidden File SystemtechniqueATT&CK mapping
Peripheral Device DiscoverytechniqueATT&CK mapping

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Equation Group's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

1 / 4

Mean robustness (of covered)

Useful?