Kaspersky Lab Uncovers More Evidence Linking NSA to Infamous Hackers

Researchers from the Russia-based cybersecurity group Kaspersky Lab have uncovered more evidence tying the United States’ National Security Agency to a shadowy group of hackers.
The hacking collective, dubbed “Equation Group,” must have been sponsored by a nation-state with vast resources in order to operate, Kaspersky analysts assert.

The strongest evidence connecting the NSA to Equation Group is the string “BACKSNARF_AB25,” which was embedded in a sample of the Equation Group cyberespionage platform known as “EquationDrug.”

“BACKSNARF,” according to page 19 of an undated NSA presentation that was obtained by Ars Technica, was the name of a project tied to the NSA’s Tailored Access Operations.

“While the presence of the ‘BACKSNARF’ artifact isn’t conclusive proof it was part of the NSA project by that name, the chances that there were two unrelated projects with nation-state funding seems infinitesimally small,” Dan Gooding of Ars Technica points out.

A new report published Wednesday by Kaspersky notes that timestamps stored inside the Equation Group malware showed that hackers almost exclusively worked Monday through Friday. Assuming they worked from 8 a.m. to 5 p.m., employees likely were working in the eastern part of the US.

(read more)