My Authors
Read all threads
Reading the NSA and FBI report of Russian GRU 85th GTsSS using the Linux based Drovorub Malware. What stands out to me the most (so far) is the kernel level rootkit (stealth capabilities). All the other features seem pretty simple to emulate for Linux.…
There are 4 modules: server, client, kernel-module, and agent. I like how they differentiate between client and agent where the agent does not include the kernel-module and is more for relaying and data staging. The server uses MySQL back-end, similar to other C2 frameworks.
"The name Drovorub comes from a variety of artifacts discovered in Drovorub files and from operations
conducted by the GTsSS using this malware; it is the name used by the GTsSS actors themselves. Taken together,
they translate to “woodcutter” or “to split wood.”
Server is configured like a typical C2 server, there is key exchange, and it seems to be a JSON formatted plain text configuration files. There is an initial signin for registering client and then signin afterwards. Paper goes deep into C2 functionality. #C2Matrix
Host Communication section on page 33 of PDF (27 of paper) is where it covers how the kernel-module works to hide on the host. (communicate over a designated pseudo-device (e.g. /dev/zero) that is not traditionally used for bi-directional, full duplex input/output (I/O).
Extensive section on detection (use outbound proxy, review network communication, yara, snort, etc.) and prevention (apply patches, prevent untrusted/unsigned kernel modules) following industry best practices most of us know to do already. Good that FBI/NSA called out GRU. /fin
Missing some Tweet in this thread? You can try to force a refresh.

Keep Current with Jorge Orchilles | Unicon August 20

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!