Shadow Brokers Malware Coverage
Summary: The Shadow Brokers released what appears to be a series of Windows rootkit components in a farewell message, including many Windows malware files that reportedly trigger as either "equationdrug.generic" or "equationdrug.k" in Kaspersky's product. The files are signed with the same key used previously for Equation Group malware, indicating they came from the same threat actor, and Talos states it has convicted these files and will continue to monitor for additional action.
What you should know: The signing key ties this release to the Equation Group, so the files carry the provenance of a known state-linked actor rather than an unknown one. Talos has convicted the files but the source gives no detail on which systems or how many are affected, leaving scope unclear.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026