Netskope Threat Labs

EquationDrug

ATP Sandbox Adv. HeuristicsAV

EquationDrug is an espionage platform attributed to the Equation Group, documented in depth by Kaspersky in 2015 as part of the Equation toolset. Its components include a rootkit driver, and the platform represented years of intelligence collection capability.

First seen
February 2022
Last seen
October 2026
Equationdrug
Alert Name
Linux.Trojan.EquationDrug
Trojan.EquationDrug.P
Trojan.Win32.EquationDrug.A
Win32.Trojan.Equationdrug
Win32.Trojan.EquationDrug
Win64.Trojan.EquationDrug