FBI - NSA joint warning for new malware

The FBI and the NSA released a joint statement today warning ασφαλείας που περιέχει λεπτομέρειες για ένα νέο στέλεχος κακόβουλου λογισμικού Linux. Και οι δύο υπηρεσίες αναφέρουν ότι αναπτύχθηκε και χρησιμοποιήθηκε σε πραγματικές επιθέσεις από στρατιωτικούς hackers της Ρωσίας.

Both companies report that Russian hackers used the malicious Drovorub software from backdoors in compromised networks.

Με βάση τα στοιχεία που έχουν συλλέξει οι δύο υπηρεσίες, αξιωματούχοι του FBI και της NSA ισχυρίζονται ότι το κακόβουλο λογισμικό είναι έργο της APT28 (Fancy Bear, Sednit), ένα κωδικό όνομα που δόθηκε στους hackers που λειτουργούν στην στρατιωτική μονάδα 26165 της Διεύθυνσης Κεντρικής Πληροφορίας του Γενικού Επιτελείου της Ρωσίας (GRU από το General Staff Main market Directorate) at the 85th Main SpecialService Center (GTsSS).

Through their joint warning, the two agencies hope to raise awareness among the private and public sectors USA, so that system administrators can quickly patch their systems, or add detection rules and prevention measures.

According to the two services, Drovorub is a multi-component system that comes with an implant, a kernel module rootkit, a file transfer tool, a port-forwarding module, and of course a command-and-control (C2) server.

The technical details released today by the NSA and FBI about APT28's Drovorub toolkit are valuable to cyber investigators.

To prevent attacks, services recommend that organizations update any Linux system to a version running Kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement, a security feature that would prevent APT28 intruders. to Install the Drovorub Rootkit |

The joint security alert [PDF] contains instructions for variability, file hide behavior detection, Snort rules, and Yara rules. Of course all of the above are useful for developing appropriate detection measures.

Some interesting details we gathered from the 45 page security warning:

The Drovorub name is the name used by APT28 for malware, not the NSA or FBI.
It comes from drovo [როво], which translates to "firewood", or "wood", and [руб], which translates to "to fall" or "to cut".
The FBI and NSA say they have been able to link Drovorub to APT28 after Russian hackers re-used servers they had used before.
For example, both services claim that Drovorub was connecting to a C&C server previously used for functions of APT28 targeting IoT devices in spring 2019. The IP address was documented by Microsoft.