Excerpt
Research By: Mark Lechtik & Nadav Grossman
Introduction
Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants of the Equation tools were used by the group prior to ‘The Shadow Brokers’ public leak in 2017. Moreover, it seems that APT3 developed its own in-house capabilities and equipped its attack tool with a 0-day that targeted the Windows operating system.
Following these revelations, we decided to expand on Symantec’s findings and take a deeper look…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
On the same topics
- ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoftMandiant (Google) · Published 25 Sep
- TA488 Targets Zimbra Mailservers with Half-Click ExploitsProofpoint · Published 15 Jul
- Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukrainebluecyber.hashnode.dev · Published 22 Jul
- DragonBreath: Dragon in the Kernelransom-isac.com · Published 22 Apr
