Unraveling Shadows: Exploring the Realm of Elite

Cyber Spies
Fatemeh Khoda Parast⇤
[email protected]
Faculty of Computer Science, University of Guelph, Canada

Abstract—The Equation Group, an advanced persistent threat

identified by Kaspersky’s Research Lab in 2015, was detected during Kaspersky Shadow Brokers Shadow Brokers
the investigation of the Regin malware. Attributed to the United announced the lists the servers revealed the password
discovery of the compromised by of encrypted files that
States National Security Agency, the Equation Group’s techniques group at a security EQGRP. were released last
are more advanced than previously discovered threats. Despite being summit in Mexico. year.
identified in 2015, detailed studies of their tactics, techniques, and
procedures have been limited. This research examines the artifacts left
by the group, revealing their advanced methodologies and analyzing Feb 2015 Aug 2016 Oct 2016 Nov 2016 Apr 2017 May 2017
the defensive mechanisms embedded within these artifacts designed
to avoid detection by security systems. Additionally, solutions are
proposed at various levels of the digital systems stack to counter the Shadow Brokers crowd- Destructive
Shadow Brokers
group’s sophisticated attack strategies effectively. stole EQGRP funded by selling the malware attack
Index Terms—Equation Group, APTs, Malware Analysis. codes. leaked code during the using EQGRP
Black Friday sale. source code

I. I NTRODUCTION
Advanced Persistent Threats (APTs) are state-sponsored hackers Figure 1: Equation Group Code Leake History
using sophisticated techniques to carry out targeted attacks. These
groups are often affiliated with government agencies and have
access to extensive resources, including funding, personnel, and binaries in hand, Kaspersky precisely compared algorithm imple-
advanced tools [1]–[4]. During an investigation into the sophisti- mentations, verifying the accuracy of Shadow Brokers’ audacious
cated malware Regin, Kaspersky uncovered an even more advanced claim. Shadow Brokers initially demanded $500 million in an
malware. As the investigation continued, Kaspersky collected ad- auction to disclose the password for the source code. When the
ditional artifacts apparently developed by the same group. This auction failed to attract buyers, they opted for a mass sale on Black
APT group was named Equation Group (EQGRP) and attributed Friday. Then, in April 2017, Shadow Brokers made a damaging
to the United States National Security Agency (NSA) based on decision by releasing the passwords. The outcome of this practice
the compelling evidence, such as activity timestamps matching US was numerous destructive attacks followed, leveraging techniques
working hours and exploit methods similar to those used in US- from the EQGRP code, including the infamous WannaCry and
attributed malware like Stuxnet [5], [6]. EQGRP employs various NotPetya ransomware attacks [10]. Figure 1 indicates the EQGRP
techniques, including web-based exploits, self-replicating worms, artifact discovery timeline.
and the interception and manipulation of legitimate physical media To date, EQGRP artifacts resemble a puzzle with many missing
and electronics. One notable method involves using USB sticks pieces. We have obtained numerous malware binaries designed
combined with various exploits to achieve its objectives [7]–[9]. for various stages of an attack, shared by Kaspersky—hosted by
One year after Kaspersky research lab discovered the EQGRP’s the famous malware sharing platforms, VirusShare1 and Malware
malware binaries in the wild, a Russian-based APT group known Bazzar2 —and from a source code repository on GitHub titled
as Shadow Brokers claimed to have stolen the EQGRP’s hacking
source codes. The leaked data contained two zip files: one protected 1 https://virusshare.com

by a password and the one publicly accessible. With the EQGRP’s 2 https://bazaar.abuse.ch
 II. T HREAT M ODEL
Reconnaissance The Equation Group’s victims span over 30 countries, includ-

Double and Triple

Fanny
ing Iran, Afghanistan, Russia, Syria, the United States, Lebanon,
Pre-exploit

Fantasy
Weaponization Palestine, France, Germany, Singapore, Qatar, the United Kingdom,
India, and Brazil. These victims come from a wide range of sectors,
such as government and diplomatic institutions, telecommunica-
Delivery tions, aerospace, energy, nuclear research, oil and gas, military, nan-

EquationLaser
otechnology, Islamic activists and scholars, mass media, transporta-
Exploit

Exploitation tion, financial institutions, and companies developing cryptographic

EquatioDrug and technologies [11], [12].
Following the attack kill chain methodology, illustrated in Fig-
Installation
GrayFish
ure 2, attackers execute their objectives through various stages [13].
Post-exploit

The EQGRP possesses a robust arsenal of tools to facilitate each

Command & Control attack stage. DOUBLEFANTASY and TRIPLEFANTASY serve to
validate victims and ascertain their level of interest, maintaining
a backdoor into the computer of potentially significant targets.
Action on Target
EQUATIONLASER functions as a Trojan dropper, facilitating the
initial infiltration of systems. EQUATIONDRUG and GRAYFISH
Figure 2: Exploit Platform Stages Corresponding to The Cyber serve as attack platforms, enabling the theft of information and
Kill Chain Methodology. facilitating the delivery of the objective on the target. FANNY
operates as a worm designed explicitly for mapping air-gapped
networks, further expanding the reach of the attackers [5], [6].
The EQGRP, with its specialized focus on air-gapped and non-
Lost in Translation3 , which primarily focuses on the post-exploit air-gapped network intrusions, operates with a level of sophisti-
stage. In this study, we connect the different parts of the puzzle cation that demands our highest attention. The attack chain typi-
and propose solutions to protect systems against the employed cally exploits zero-day vulnerabilities in non-air-gapped networks,
vulnerabilities. whereas the physical access defines the primary model in the air-
This research focuses on the malware binaries caught in the wild gapped systems, showcasing the group’s advanced tactics [14], [15].
to answer the following questions:
A. Air-gapped Networks
1) Define the attack target threat models.
2) Analyze how EQGRP infects targets through the exploit Attacks using physical media, such as CD-ROMs, suggest using
chain. a highly stealthy tactic known as interdiction, where malicious
3) Investigate how attackers maintain persistence within com- actors intercept and replace shipped items with compromised
promised systems. versions [16], [17]. An incident that underscored the real-world
4) Examine the evasion techniques used by the group. implications of cyber attacks was the targeting of attendees of
5) Develop strategies to protect systems throughout the attack a scientific conference in Houston. Post-event, some participants
chain using layered defence techniques. received a seemingly harmless package by mail with conference
proceedings and a slideshow of event materials. However, the
The rest of this paper is organized as follows. Section II elabo-
enclosed CD maintained infected autorun software, a gateway to
rates on the group’s threat model. Section III discusses the group’s
a potential system breach. The primary objective of the infected
techniques and attack platforms. Evasion techniques are discussed
USB with FANNY malware was to map air-gapped networks using
at Section IV followed by the protection and detection methods at
a unique USB-based command and control mechanism. Once the
Section V. Finally, we conclude and propose the future research
target was infected through the USB stick, FANNY identified the
direction on Section VI.
network components. The following stages of the attack varied
depending on the objectives. If the goal were data collection,
3 https://github.com/x0rz/EQGRP Lost in Translation FANNY would gather essential system information, store it in the
USB’s hidden section, and later transmit it when connected to an deactivates the authentication, EPICBANANA exploits a local
internet-enabled machine. Despite the limited hidden space, it could command-line buffer overflow vulnerability to implant the next
store critical information, including credentials. Attackers could stage payload. EPICBANANA uses a precisely crafted input to exe-
encode instructions in the USB’s hidden storage area to execute cute arbitrary code on the target machine, potentially taking control
commands on air-gapped networks. When inserted into the air- of the entire system (Listing 1, line 8). Afterward, communication
gapped computer, FANNY would detect the system elements and with the firewall via BANALRIDE becomes possible, enabling fur-
execute the commands. This method allowed the EQGRP to control ther interaction and exploitation of the system through established
air-gapped networks via infected USB sticks while mapping their connections. Using the bride tool, attackers first communicate with
architecture [18]. the firewall, exchange a 21-byte UDP packet to establish a Diffie-
Hellman key, and create an encrypted channel (Listing 1, line 12).
B. Non-air-gapped Network Finally, they install BANAGLEE into the firewall’s memory. This
One of the group’s techniques involves exploiting vulnerabilities established channel facilitates data transfer and execution of further
in firewalls’ Simple Network Management Protocol (SNMP) and commands, expanding the attacker’s control and manipulation over
Command Line Interface (CLI) [19]. SNMP is essential for man- the compromised system. Table I summarizes the pre-exploit chain
aging network devices, enabling the exchange of management data artifacts and indicates the corresponding Common Vulnerabilities
among routers, switches, servers, and printers. Cisco firewalls offer and Exposure (CVE) values. The attack scripts are available within
administrators a CLI for configuring and managing the devices. Two the Lost in Translation GitHub repository.
models of Cisco firewalls, the Private Internet Exchange (PIX) and
Adaptive Security Appliance (ASA), are particularly susceptible 1 // EXTRABACON
to these exploits. PIX is an earlier version of Cisco’s standalone 2
firewall technology, while ASA is its successor. ASA provides 3 $ ./extrabacon.py target_machine_info -t <victim_ip> -c
comprehensive support for firewalling, Virtual Private Networks password
4 $ ./extrabacon.py exec -k target_machine_info -t
(VPN), Intrusion Prevention Systems (IPS), Intrusion Detection <victim_ip> -c password --mode pass-disabled
Systems (IDS), and content filtering, making it a fully equipped 5
security solution. Exploiting vulnerabilities in these systems in- 6 // EPICBANANA
volves more than unauthorized access; it includes crafting malicious 7
commands or inputs to exploit parser weaknesses. This can result 8 $ ./epicbanana.py -t <victim_ip> --proto=ssh
--username=user_name --password=the_pass
in severe consequences, such as executing unauthorized commands, --arget_vers=asa804 --mem=NA -p 22
bypassing access controls, modifying firewall configurations, or 9
even gaining elevated privileges on the device [20], [21]. 10 //BANALRIDE
11
III. T ECHNICAL A NALYSIS OF EQGRP M ETHODS 12 $ ./bride-1100 --lp <victim_ip> --implant <attacker_ip>
--sport <victim_port> --dport <attacker_port>
The following conditions must be met to manipulate a non-air-
gapped system through the SNMP vulnerability successfully: (1) Listing 1: Exploit Chain [22]
SNMP must be enabled on the target system, (2) the community
string must be known or discovered, (3) the attack must utilize
A. Exploit Platforms
IPv4, and (4) there must be access to systems on the activated
firewall interface. The primary tools designed to exploit the system EQUATIONDRUG and GRAYFISH are the primary cyber espi-
are EXTRABACON, EPICBANANA, and BANALRIDE. onage platforms used by the group, both utilizing boot manipulation
EXTRABACON is implemented as a Python script designed techniques. In a typical boot process, the CPU starts in real mode
to deactivate the firewall authentication. To deliver the exploit, and executes the Basic Input/Output System (BIOS). The BIOS then
the attacker must know the community string—which functions identifies and transfers control to the Master Boot Record (MBR).
similarly to a password—and the target’s IP address. Using the The MBR, located in the first sector of the system’s hard disk,
script and providing the necessary details, attackers can gather navigates the partition table (PT) to locate the designated bootable
information about the target machine to deactivate password-based partition, where the operating system (OS) is usually stored. Control
authentication (Listing 1, lines 3 and 4). Once EXTRABACON is then handed over to the Volume Boot Record (VBR) within
Table I EQGRP Exploit Chain Tools.

Exploit CVE Vulnerability Description

EXTRABACON CVE-2016-6366 Turn the firewall password ON or Remote code execution
OFF
EPICBANANA CVE-2016-6367 Exploit SSH or Telnet CLI remote code execution
BANALRIDE N/A N/A Establish secure channel with C&C server, load
BANAGLEE
BANAGLEE N/A N/A Communicate with C&C server, network traffic
manipulation
JETPLOW N/A N/A Persistent BANAGLEE between reboots

Protected Mode
plugins, each with a unique ID and version number defining
Real Mode
its specific functions. The platform includes default plugins for
User
tasks such as file retrieval and screenshot capture. It enhances its
BIOS MBR VBR Bootloader OS Kernel
Processes sophistication by encrypting stolen data within a proprietary virtual
file system before transmitting it to C&C servers. The platform
initiates with the kernel mode driver component, which waits for
Figure 3: BIOS-based Systems Boot Procedure [23] system startup and then triggers the execution of the user-mode
loader mscfg32.exe, subsequently launching the central orchestrator
module from mscfg32.dll. Both intrinsic and supplementary com-
the bootable partition. Once the MBR has determined the bootable ponents may load additional drivers and libraries as needed [2], [5],
partition, the VBR code loads the first stage of the bootloader into [18].
memory and passes control to it. The bootloader retrieves additional GRAYFISH, as the upgraded version of the EQUATIONDRUG,
code from the disk, switches to protected mode, and then loads and employs a bootkit for persistency, embedding its code into the
executes the kernel [23], [24]. Figure 3 illustrates the boot sequence MBR during computer startup, thereby taking control of the OS’s
in real and protected mode. loading process—the platform stores stolen files in an encrypted
Within the disk layout, specific segments are designated as dark Virtual File System (VFS) to secure its presence. The malware’s
regions, which exist outside the boundaries of a filesystem. Since loader employs a robust encryption method, utilizing SHA-256
these regions are not part of any filesystem structure, they remain iterated one thousand times over the unique NTFS object ID of
hidden and inaccessible during regular system operations. Examples the victim’s Windows folder, ensuring that decryption requires this
of dark areas include the MBR, VBR, bootloader, inter-partition specific information. This complex encryption scheme enhances
gaps, and the space extending beyond the last partition to the security by making reverse engineering difficult and decryption
physical end of the disk. These gaps often span several megabytes nearly impossible without the exact NTFS object ID. Additionally,
on most systems. Dark regions appeal to attackers because they GRAYFISH uses evasive tactics by self-destructing entirely in case
are infrequently modified, typically only during major OS updates of startup errors, leaving no traces behind [25], [26].
or other rare events. Additionally, most protection mechanisms GRAYFISH utilizes a Windows kernel rootkit to conduct its
overlook these regions since they primarily focus on the filesystem malicious operations in the highly privileged Ring 0 mode (kernel
level [23]. mode). This rootkit facilitates code injection into running processes
EQUATIONDRUG is an intricate exploit platform that outper- and employs several tricks to confuse security researchers analyzing
forms a Trojan to function as a comprehensive espionage tool, live systems for kernel-mode anomalies. During the DriverObject
facilitating cyber espionage by deploying tailored modules onto initialization, the rootkit retrieves the hardcoded process ID within
targeted victims’ machines. At its core, EQUATIONDRUG com- its code and attempts to acquire the address of its process ob-
prises a collection of drivers, a central orchestrator, and various ject using PsLookupProcessByProcessId. Subsequently, it creates a
 Retrieve the dynamic Get pointer to an OS Create a new driver Handler to the device
Lookup process id Build buffer Make Handle
imports created drive object object

Keep sensitive data encrypted Keep pointers encrypted \Drive\ACPI Obfuscate the new drive Hijack the DriveObject field
DriveObject Initialization Make a handle to
Decrypt only on the stack \Drive\PnpManager creation of the NullFileObject
\Device\Null
Encrypt again before exiting \Drive\ACPI_HAL Copy some field of the Modify it with a pointer to
\Drive\mountmgr Belonging to \Driver\Null
func. selected driver to the newly the rootkit device object
Use simple algorithms, e.g., xor. created one The user mode part of the
malware communicates with
the rootkit via a highjacked
device object

Figure 4: Rootkit OS Kernel Driver Highjack

buffer or data storage area to store information about specific kernel anti-analysis checks to make dynamic and static analysis more
functions of the targeted OS. This buffer is organized with each difficult. The groups’ malware binaries are packed, making static
entry consisting of two parts: the hash value of the function’s name analysis almost useless. String extraction, performed to extract
and the function’s address. The hash value, serving as a unique suspicious strings, such as IP addresses and domain names, is not
identifier derived from the function’s name, acts as shorthand, while applicable unless the malware is executed [28].
the address indicates the function’s location within the kernel’s Anti-Virtualization Techniques: Malware may include anti-
memory space. Figure 4 illustrates the exploit chain in a high- virtualization techniques to detect if it is running within a vir-
abstract manner where the attacker starts by looking up the process tualized environment, such as a virtual machine or sandbox, and
ID to highjack the kernel driver. alter its behaviour to avoid detection or analysis. The method can
Hard drives, a crucial component of any system, have a controller involve checking for virtualized hardware, registry keys, or specific
with firmware stored in a memory chip or flash ROM. When virtualization artifacts [29]. The group’s malware includes calling
EQUATIONDRUG or GRAYFISH infiltrates a system, the firmware SleepEx function to halt the execution. The function calculates the
flasher module connects to a command server to download and delay period for execution, assuming that the sandbox session will
implant a malicious payload code into the firmware, replacing terminate before this delay period elapses.
the legitimate version. This trojanized firmware, a proof to the Staged Payloads: The group employs staged payloads, where the
malware’s persistence, allows attackers to maintain access, even initial payload is benign or harmless, and only after some time or
after software updates or OS reinstalls, as it can restore wiped specific conditions are met does it download and execute the actual
components by contacting the command server. It’s important to malicious payload. This method evades detection by delaying the
note that vendor firmware updates may not remove the malicious execution of malicious activities until after initial security checks
code, as updates often replace only firmware parts. have passed [30]. The EQGRP uses a multi-stage payload where,
in case of any error, the malware has the self-destruction ability to
IV. E VASION T ECHNIQUES remove any traces in the system. Only if a stage is successful will
The EQGRP applies various evasion techniques in different the next stage payload be transferred to the target.
stages of an attack, making intrusion detection a complex proce- Traffic and Communication Obfuscation: Malicious actors
dure. This section discusses the most prevalent evasion techniques obfuscate the network traffic and communication channels using
used through the group’s exploit chain. encryption, tunnelling, or legitimate protocols to blend in with reg-
Fileless Malware: This method avoids the need to write any files ular network traffic. Obfuscation makes it harder for network-based
to disk, thus reducing the chances of detection. Once the initial detection systems to identify and block malicious activity [31].
access is gained, the EQGRP’s tools, such as EQUATIONDRUG The EQGRP extensively uses encryption at every stage, including
and GRAYFISH, deploy payloads that reside entirely in memory. the malware code, the stolen data storage within the VFS, and
These tools can load additional modules and execute commands communications with the C&C server.
directly within the memory space of compromised systems [27].
Anti-Debugging and Anti-Reversing Techniques: Malicious V. P ROTECTION AND D ETECTION M ECHANISM
code often employs anti-debugging and anti-reversing techniques The Equation Group targets air-gapped and non-air-gapped net-
to prevent security researchers from analyzing it. These techniques works, making comprehensive security measures essential for or-
include obfuscating code, detecting debuggers, and employing ganizations. A multifaceted approach is necessary to secure an
organization’s ecosystem effectively. While deploying advanced by hardware protections. Additionally, the update process must be
solutions such as firewalls, VPNs, IDS, and IPS is critical to prevent non-bypassable, ensuring no component can override the authenti-
unauthorized access, these measures alone are insufficient [32]. cated update mechanism, safeguarding against unauthorized BIOS
Regular software patching, physical access control enforcement, modifications [37], [38].
and user awareness are equally vital steps to reduce the likelihood
of successful attacks. Beyond these standard measures, specialized VI. C ONCLUTION AND F UTURE W ORK
protection mechanisms are required to address the specific vulner- This research is a brief study of the Equation Group’s puzzle.
abilities the EQGRP utilizes to exploit the systems. The investigation reveals a highly sophisticated and resourceful
Safe listed devices: A security detection and prevention method cyber-espionage entity attributed to the United States National
is used to enhance the protection of a network or system by Security Agency. This group employs advanced techniques to
allowing only approved, trusted devices to access the network infiltrate air-gapped and non-air-gapped networks, leveraging zero-
or system resources. Creating and maintaining a safelist can be day vulnerabilities and innovative evasion methods. The analysis of
resource-intensive, requiring ongoing management and updates. their tactics, techniques, and procedures highlights their ability to
If a legitimate device is not correctly safe listed, it could be remain undetected for extended periods, compromising numerous
denied access, potentially disrupting business operations. To address sectors across the globe. The Equation Group’s use of tools like
the challenges, implementing a two-factor authentication system EQUATIONDRUG and GRAYFISH, which exploit deep system
for USB storage devices can be applied to protect systems from vulnerabilities, underscores the need for robust, multi-layered de-
malicious activities carried out through USB devices [33]. fensive strategies. The impact of their operations, particularly in
VLAN (Virtual Local Area Network) segmentation VLAN the wake of the Shadow Brokers’ leaks, demonstrates the potential
segmentation involves dividing a physical network into multiple for significant global disruptions and the ongoing challenge of
distinct logical networks. Each VLAN behaves like an independent defending against such advanced persistent threats.
network, even though multiple VLANs may share the same physical Future research should focus on developing more advanced
infrastructure. Configuring VLANs can be complex, especially detection and prevention mechanisms tailored to the unique chal-
in large networks with many devices. Maintaining and updating lenges posed by groups like the Equation Group, including enhanc-
VLAN configurations can become increasingly complicated as ing real-time monitoring capabilities, employing machine learning
the network evolves. Inter-VLAN routing, necessary for enabling algorithms for anomaly detection, and improving the resilience
communication between different VLANs, adds another layer of of firmware against sophisticated attacks. Additionally, a collab-
complexity [34]. oration between government agencies, private sector companies,
Overflow preventive: Buffer overflow vulnerabilities occur when and international cybersecurity organizations is essential to share
a program writes more data to a buffer than it can handle, potentially threat intelligence and develop unified defence strategies. Further
leading to memory corruption and exploitation by attackers. To studies should also explore the socio-political implications of state-
prevent buffer overflow attacks, developers can implement various sponsored cyber espionage, aiming to establish more evident norms
preventive measures, such as bounds checking, input validation, and regulations to mitigate the risks associated with such activities.
stack canaries, and address space layout randomization (ASLR). While this study analyzed the pre-exploit and exploit stages using
Methods such as stack canaries, bounds checking, and runtime binary artifacts, future studies can focus on post-exploit tools.
protections can introduce significant performance overhead. Older These tools are invaluable assets for security professionals and
software might not be compatible with new security features or offer significant potential for research in security monitoring and
might require significant modifications [35], [36]. management tasks.
Firmware manipulation protection: The NIST Special Pub-
lication 800-147 outlines a comprehensive solution for securing R EFERENCES
firmware through several vital guidelines. It mandates using an au- [1] A. Alshamrani, S. Myneni, A. Chowdhary, and D. Huang, “A survey on
thenticated BIOS update mechanism, employing digital signatures advanced persistent threats: Techniques, solutions, challenges, and research
opportunities,” IEEE Communications Surveys & Tutorials, vol. 21, no. 2,
to ensure only authenticated updates are applied. An optional secure pp. 1851–1877, 2019.
local update mechanism allows updates with physical presence, [2] A. Sharma, B. B. Gupta, A. K. Singh, and V. Saraswat, “Advanced persistent
ensuring authenticity and integrity. Integrity protection mechanisms threats (apt): evolution, anatomy, attribution and countermeasures,” Journal of
Ambient Intelligence and Humanized Computing, vol. 14, no. 7, pp. 9355–
must prevent unauthorized BIOS modifications, typically enforced 9381, 2023.
 [3] A. Lemay, J. Calvet, F. Menet, and J. M. Fernandez, “Survey of publicly [23] B. Grill, A. Bacs, C. Platzer, and H. Bos, “”Nice Boots!” - A Large-Scale
available reports on advanced persistent threat actors,” Computers & Security, Analysis of Bootkits and New Ways to Stop Them,” Lecture Notes in Computer
vol. 72, pp. 26–59, 2018. Science, pp. 25–45, Springer, 2015.
[4] N. Sun, M. Ding, J. Jiang, W. Xu, X. Mo, Y. Tai, and J. Zhang, “Cyber [24] Y. Zhou, G. Peng, Z. Li, and S. Liu, “A survey on the evolution of
threat intelligence mining for proactive cybersecurity defense: a survey and bootkits attack and defense techniques,” China Communications, vol. 21, no. 1,
new perspectives,” IEEE Communications Surveys & Tutorials, 2023. pp. 102–130, 2024.
[5] “Equation Group: The Crown Creator of Cyber-Espionage,” 2015. [25] B. Grill, Bootkits revisited: detecting, analysing and mitigating bootkit threats.
[6] “Equation Group Questions and Answers,” 2015. PhD thesis, Wien, 2016.
[7] S. Yadav, “Social automation and apt attributions in national cybersecurity,” [26] A. Baranov, “Uncovering Equation Group Ring 0 tricks: GrayFish rootkit
Journal of Cyber Security Technology, pp. 1–26, 2024. analysis,” 2023.
[8] M. Kerttunen and J. Hemmelskamp, “Impact and significance,” European [27] I. Kara, “Fileless malware threats: Recent advances, analysis approach through
Journal of Cyber Security, 2024. memory forensics and research challenges,” Expert Systems with Applications,
[9] Y. Liu, C. Li, Z. Zheng, Q. Guo, and X. Gong, “Reverse engineering vol. 214, p. 119133, 2023.
workload measure based on function classification,” in 2023 26th International [28] F. Zhong, X. Cheng, D. Yu, B. Gong, S. Song, and J. Yu, “Malfox: Cam-
Conference on Computer Supported Cooperative Work in Design (CSCWD), ouflaged adversarial malware example generation based on conv-gans against
pp. 660–665, IEEE, 2023. black-box detectors,” IEEE Transactions on Computers, 2023.
[10] “NSA malware released by Shadow Brokers hacker group,” 2017. [29] E. Debas, N. Alhumam, and K. Riad, “Unveiling the dynamic landscape of
[11] D. Goodin, “How “omnipotent” hackers tied to NSA hid for 14 years—and malware sandboxing: A comprehensive review,” 2023.
were found at last,” 2015. [30] H. Holm and E. Hyllienmark, “Hide my payload: An empirical study of
[12] “APT Q1 2023 playbook: advanced techniques, broader horizons, and new antimalware evasion tools,” in 2023 IEEE International Conference on Big
targets ,” 4 2023. Data (BigData), pp. 2989–2998, IEEE, 2023.
[13] P. N. Bahrami, A. Dehghantanha, T. Dargahi, R. M. Parizi, K.-K. R. Choo, and [31] H. J. Asghar, B. Z. H. Zhao, M. Ikram, G. Nguyen, D. Kaafar, S. Lamont, and
H. H. Javadi, “Cyber kill chain-based taxonomy of advanced persistent threat D. Coscia, “Use of cryptography in malware obfuscation,” Journal of Computer
actors: Analogy of tactics, techniques, and procedures,” Journal of information Virology and Hacking Techniques, vol. 20, no. 1, pp. 135–152, 2024.
processing systems, vol. 15, no. 4, pp. 865–889, 2019. [32] F. K. Parast, C. Sindhav, S. Nikam, H. I. Yekta, K. B. Kent, and S. Hakak,
[14] M. Guri, M. Monitz, and Y. Elovici, “Usbee: Air-gap covert-channel via “Cloud computing security: A survey of service-based models,” Computers &
electromagnetic emission from usb,” in 2016 14th Annual Conference on Security, vol. 114, p. 102580, 2022.
Privacy, Security and Trust (PST), pp. 264–268, IEEE, 2016. [33] M. F. Ayub, S. Shamshad, K. Mahmood, S. H. Islam, R. M. Parizi, and K.-
[15] M. Guri and Y. Elovici, “Bridgeware: The air-gap malware,” Communications K. R. Choo, “A provably secure two-factor authentication scheme for usb
of the ACM, vol. 61, no. 4, pp. 74–82, 2018. storage devices,” IEEE Transactions on Consumer Electronics, vol. 66, no. 4,
[16] S. H. Mim, A. A. Mim, R. Tasnim, M. I. Jabiullah, and T. Vengatesh, pp. 396–405, 2020.
“A secure network architecture for any on premises organization; possible [34] H. A Al-Ofeishat and R. Alshorman, “Build a secure network using segmenta-
vulnerabilities & their solutions in cisco,” in 2022 1st International Conference tion and micro-segmentation techniques,” International Journal of Computing
on Computational Science and Technology (ICCST), pp. 776–779, IEEE, 2022. and Digital Systems, vol. 14, no. 1, pp. 1–16, 2023.
[17] S. Tyata and A. Barsoum, “Network management protocols: Analytical study [35] M. A. Butt, Z. Ajmal, Z. I. Khan, M. Idrees, and Y. Javed, “An in-depth survey
and future research directions,” Journal of Network and Information Security, of bypassing buffer overflow mitigation techniques,” Applied Sciences, vol. 12,
vol. 9, no. 2, pp. 09–13, 2021. no. 13, p. 6702, 2022.
[18] Kaspersky, “Equation Group: from Houston with love,” 2015. [36] C. Liu, Y.-J. Wu, J.-Z. Wu, and C. Zhao, “A buffer overflow detection and
[19] H. SNMP, “Multiple vulnerabilities in snmp,” defense method based on risc-v instruction set extension,” Cybersecurity,
[20] O. Santos, “Threat Actors Exploiting SNMP Vulnerabilities in Cisco Routers,” vol. 6, no. 1, p. 45, 2023.
2023. [37] A. Regenscheid, “Bios protection guidelines for servers,” NIST Special Publi-
[21] “Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulner- cation, vol. 800, p. 147B, 2014.
ability,” 2017. [38] J. Yao and V. Zimmer, “Building secure firmware,” Apress: New York, NY,
[22] “The Shadow Brokers EPICBANANA and EXTRABACON Exploits,” 2017. USA, pp. 18–48, 2020.