#equationdrug

Kaspersky tarafından yayınlanan bir güvenlik raporu, Equation adı verilen bir gizli siber-casusluk grubunun marifetlerini biraz olsun ortaya çıkardı. Equation grubu hangi ülke ya da örgüte bağlı olarak çalışıyor, orası pek bilinmiyor. Ancak Kaspersky uzmanlarına göre bu grubun kullandığı yöntemlerin ucu Amerikan istihbarat örgütlerini ve özellikle de NSA’yı işaret ediyor.

Equation tarafından…

With operations predating at least 2001, Equation group is one of the most persistent and arguably, the most sophisticated threat groups in operation. Equation Group was discovered during Russian cyber-security firm, Kaspersky’s investigation into the Regin threat group. Kaspersky attributes Equation Group to the United States National Security Agency; however, definitive evidence of attribution remains absent. Equation group’s name derives from their employment of encryption and obfuscation strategies throughout their operations. The RC5 encryption algorithm is deployed throughout the malware and additional encryption algorithms RC6, RC4, and AES are added in other modules. Some of the attribution of the group to the United States comes from similarities between the malware platform and exploits to Stuxnet and the Gauss malware. Equation Group has globally targeted more than 500 victims in over 30 countries including Iran, Russia, Syria, Afghanistan, Kazakhstan, Belgium, Somalia, Hong Kong, Libya, United Arab Emirates, Iraq, Nigeria, Ecuador, Mexico, Malaysia, United States, Sudan, Lebanon, Palestine, France, Germany, Singapore, Qatar, Pakistan, Yemen, Mali, Switzerland, Bangladesh, South Africa, Philippines, United Kingdom, India and Brazil. Targets are affiliated with government institutions, diplomatic organizations, the telecommunication sector, aerospace firms, energy companies, nuclear research facilities, oil and gas companies, military systems, nanotechnology research facilities, Islamic activists and scholars, mass media outlets, the transportation sector, financial institutions, and companies developing cryptographic technologies. It is possible that even more infections remain undiscovered. Kaspersky estimates that Equation Group attacked 2000 targets per month in 2008; although, the estimate seems generous. Equation Group’s known C&C infrastructure spans more than 300 domains on over 100 servers.

With operations predating at least 2001, Equation group is one of the most persistent and arguably, the most sophisticated threat groups in operation. Equation Group was discovered during Russian cyber-security firm, Kaspersky’s investigation into the Regin threat group. Kaspersky attributes Equation Group to the United States National Security Agency; however, definitive evidence of attribution remains absent. Equation group’s name derives from their employment of encryption and obfuscation strategies throughout their operations. The RC5 encryption algorithm is deployed throughout the malware and additional encryption algorithms RC6, RC4, and AES are added in other modules. Some of the attribution of the group to the United States comes from similarities between the malware platform and exploits to Stuxnet and the Gauss malware. Equation Group has globally targeted more than 500 victims in over 30 countries including Iran, Russia, Syria, Afghanistan, Kazakhstan, Belgium, Somalia, Hong Kong, Libya, United Arab Emirates, Iraq, Nigeria, Ecuador, Mexico, Malaysia, United States, Sudan, Lebanon, Palestine, France, Germany, Singapore, Qatar, Pakistan, Yemen, Mali, Switzerland, Bangladesh, South Africa, Philippines, United Kingdom, India and Brazil. Targets are affiliated with government institutions, diplomatic organizations, the telecommunication sector, aerospace firms, energy companies, nuclear research facilities, oil and gas companies, military systems, nanotechnology research facilities, Islamic activists and scholars, mass media outlets, the transportation sector, financial institutions, and companies developing cryptographic technologies. It is possible that even more infections remain undiscovered. Kaspersky estimates that Equation Group attacked 2000 targets per month in 2008; although, the estimate seems generous. Equation Group’s known C&C infrastructure spans more than 300 domains on over 100 servers.

Kaspersky claims to have found NSA’s ‘space station malware’

  by  Darren Pauli

Kaspersky malware probers have uncovered a new ‘operating system’-like platform that was developed and used by the National Security Agency (NSA) in its Equation spying arsenal.

The EquationDrug or Equestre platform is used to deploy 116 modules to target computers that can siphon data and spy on victims.

“It’s important to note that EquationDrug is not just a trojan, but a…