NSA & FBI disclose new Russian-made Drovorub malware targeting Linux

guest · Aug 13, 2020

NSA discloses new Russian-made Drovorub malware targeting Linux
August 13, 2020
https://www.bleepingcomputer.com/ne...ussian-made-drovorub-malware-targeting-linux/

The National Security Agency is warning about espionage operations from the Russian Intelligence Directorate (GRU) using a previously undisclosed Linux malware toolset called Drovorub.

The malicious framework has various modules that ensure stealthiness, persistence, and complete access to the compromised machine with the highest privileges.
Rootkit ahead
The NSA today released a technical report (a joint effort with the FBI) detailing Drovorub’s capabilities and offering detection and prevention solutions. The agency says that the framework includes a kernel module rootkit that makes it difficult for network-wide security solutions to catch it.

“Drovorub is a Linux malware toolset consisting of an implant [client] coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server” - National Security Agency
Click to expand...

A complete technical analysis for each Drovorub component is available in NSA’s report, along with methods to prevent and detect the attack.
Detection and prevention
NSA’s research determined that the malware activity is visible to complementary detection techniques but these are not too effective for the Drovorub kernel module.

Furthermore, system administrators should make sure that machines are running at least Linux Kernel 3.7, which offers kernel signing enforcement.
Setting up systems to load only modules that have a valid digital signature increases the difficulty level for planting malicious kernel modules.
Click to expand...

Report: "Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware"
(PDF - 2.00 MB): https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

guest · Aug 13, 2020

Joint NSA and FBI Cybersecurity Advisory Discloses Russian Malware Drovorub
August 13, 2020
https://us-cert.cisa.gov/ncas/curre...ersecurity-advisory-discloses-russian-malware

The National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) have released a cybersecurity advisory introducing previously undisclosed Russian malware. NSA and the FBI attributed the malware, dubbed Drovorub, to Russian advanced persistent threat (APT) actors.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the joint advisory and employ its detection techniques and mitigations.
Click to expand...

guest · Aug 14, 2020

On Drovorub: Linux Kernel Security Best Practices
August 13, 2020
https://www.mcafee.com/blogs/other-...rovorub-linux-kernel-security-best-practices/

In a U.S. government cyber security advisory released today, the National Security Agency and Federal Bureau of Investigation warn of a previously undisclosed piece of Linux rootkit malware called Drovorub and attribute the threat to malicious actor APT28. The report is incredibly detailed and proposes several complementary detection techniques to effectively identify Drovorub malware activity.

Keeping a system updated and fully protected isn’t specific to Windows-based environments. Linux-based systems are widespread within many enterprise organizations, often operating outside the direct visibility of system administrators. Partly because of this low visibility, threat actors embrace the Linux Stack as an ideal hiding place and launch point for lateral movement.
Click to expand...

For specific McAfee technology protections against Drovorub please visit the dedicated Drovorub KB article here.
In addition to the guidance provided in the U.S. government report and our product specific knowledge base article, McAfee encourages organizations to take note of and apply the following best practices (where possible) for rootkit detection and kernel security.
Click to expand...

guest · Nov 14, 2020

Schneider Electric Warns Customers of Drovorub Linux Malware
November 14, 2020
https://www.securityweek.com/schneider-electric-warns-customers-drovorub-linux-malware

The U.S. agencies issued a joint advisory in mid-August to warn organizations that the cyber-espionage group known as APT28, which has been linked to Russia’s General Staff Main Intelligence Directorate (GRU), has been using a piece of Linux malware named Drovorub.

Drovorub includes an implant, a kernel module rootkit, file transfer and port forwarding tools, and a C&C server. Once it has been deployed on a device, the malware allows its operators to download and upload files, execute commands with root privileges, and conduct port forwarding. It also has mechanisms for persistence and evading detection.
Click to expand...

Schneider Electric has advised customers to implement defense-in-depth recommendations in order to protect their Trio Q Data Radio and Trio J Data Radio devices against the malware.
The French industrial giant told SecurityWeek that while Drovorub can pose a threat to its devices, it’s not actually aware of any incident involving the malware.

“When we learned how Drovorub worked, we looked to all of our Linux devices to see if they had the same vulnerabilities. Out of an abundance of caution, we elected to let our users know of the potential issue and offered a mitigation while a fix to the OS was prepared,” Andrew Kling, product security officer at Schneider Electric, said via email.
Click to expand...

“By default, the Trio radios are not vulnerable because malware in this form cannot be loaded onto them without modification. A user would have to use unsecured protocols and fail to implement role-based access control to get the radios to be potentially vulnerable,” Kling added.
Click to expand...

Log in or Sign up

NSA & FBI disclose new Russian-made Drovorub malware targeting Linux

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

NSA & FBI disclose new Russian-made Drovorub malware targeting Linux

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches