FBI - NSA joint warning for new malware

The FBI and NSA today released a joint security alert detailing a new strain maliciousy Linux software. Both agencies say it was developed and used in actual attacks by Russian military hackers.

The two Companies report that Russian hackers used the Drovorub malware from backdoors into compromised networks.

Based on data collected by the two agencies, FBI and NSA officials claim the malware is the work of APT28 (Fancy Bear, Sednit), a code name given to hackers operating in the Central Intelligence Agency's military unit 26165 of the General Staff of Russia (GRU from General Staff Main Intelligence Directorate) in the 85th Main SpecialService Center (GTsSS).

Through their joint warning, the two services hope to raise awareness in the US private and public sectors so that system administrators can quickly repair their systems, or add detection rules and prevention measures.

Σύμφωνα με τις δύο υπηρεσίες, το Drovorub είναι ένα σύστημα πολλαπλών συστατικών που συνοδεύεται από implant, ένα kernel module rootkit, ένα file transfer tool, a port-forwarding module, and of course a command-and-control (C2) server.

The technical details released today by the NSA and FBI about APT28's Drovorub toolkit are valuable to cyber investigators.

To prevent attacks, services recommend that organizations update any Linux system to a version running Kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement, a security feature that would prevent APT28 intruders. to Install the Drovorub Rootkit |

The joint security alert [PDF] contains instructions for variability, file hide behavior detection, Snort rules, and Yara rules. Of course all of the above are useful for developing appropriate detection measures.

Some interesting details we gathered from the 45 page security warning:

The Drovorub name is the name used by APT28 for malware, not the NSA or FBI.
It comes from drovo [როво], which translates to "firewood", or "wood", and [руб], which translates to "to fall" or "to cut".
The FBI and NSA say they have been able to link Drovorub to APT28 after Russian hackers re-used servers they had used before.
For example, both agencies claim that Drovorub connected to a C&C server previously used for APT28 operations targeting Appliances IoT in Spring 2019. The IP address was documented by Microsoft.