The FBI and NSA today released a joint security warning detailing a new strain of Linux malware. Both services say it was developed and used in actual attacks by Russian military hackers.
Both companies report that Russian hackers used the malicious Drovorub software from backdoors in compromised networks.
Based on the information gathered by the two services, FBI and NSA officials claim that the malware is the work of APT28 (Fancy Bear, Sednit), a code name given to the hackers operating in the 26165 military unit of the Central Intelligence Agency. of the General Staff of Russia (GRU from the General Staff Main Intelligence Directorate) at the 85th Main SpecialService Center (GTsSS).
Through their joint warning, the two services hope to raise awareness in the US private and public sectors so that system administrators can quickly repair their systems, or add detection rules and prevention measures.
According to the two services, Drovorub is a multi-component system that comes with an implant, a kernel module rootkit, a file transfer tool, a port-forwarding module, and of course a command-and-control (C2) server.
The technical details released today by the NSA and FBI about APT28's Drovorub toolkit are valuable to cyber investigators.
To prevent attacks, services recommend that organizations update any Linux system to a version running Kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement, a security feature that would prevent APT28 intruders. to Install the Drovorub Rootkit |
The joint security alert [PDF] contains instructions for variability, file hide behavior detection, Snort rules, and Yara rules. Of course all of the above are useful for developing appropriate detection measures.
Some interesting details we gathered from the 45 page security warning:
The Drovorub name is the name used by APT28 for malware, not the NSA or FBI.
It comes from drovo [როво], which translates to "firewood", or "wood", and [руб], which translates to "to fall" or "to cut".
The FBI and NSA say they have been able to link Drovorub to APT28 after Russian hackers re-used servers they had used before.
For example, both services claim that Drovorub was connected to a C&C server that had previously been used for APT28 operations targeting IoT devices in the spring of 2019. The IP address was documented by Microsoft.