Security News > 2021 > February > Chinese Hackers Cloned Equation Group Exploit Years Before Shadow Brokers Leak

A Chinese threat actor known as APT31 likely acquired and cloned one of the Equation Group's exploits three years before the targeted vulnerability was publicly exposed as part of Shadow Brokers' "Lost in Translation" leak, cybersecurity firm Check Point says in a new report.

Attributed to APT31, a Chinese hacking group also tracked as Zirconium, the exploit for this vulnerability is the clone of an Equation Group exploit code-named "EpMe," Check Point says.

Exploitation tools that the Equation Group had been using for years were made public in early 2017 by a mysterious group calling themselves Shadow Brokers.

Called Jian and attributed to APT31, the exploit for this vulnerability is now believed to be the clone of an Equation Group exploit that targeted the same security hole.

Further analysis has revealed that the exploits contain artefacts specific to the Equation Group tools, suggesting that EpMe was the original exploit for CVE-2017-0005, Check Point says.

"To our surprise, we found out that this APT31 exploit is in fact a reconstructed version of an Equation Group exploit called 'EpMe'. This means that an Equation Group exploit was eventually used by a Chinese-affiliated group, probably against American targets," Check Point notes.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/WdkRgZ0AUog/chinese-hackers-cloned-equation-group-exploit-years-shadow-brokers-leak