Reading the NSA and FBI report of Russian GRU 85th GTsSS using the Linux based Drovorub Malware. What stands out to me the most (so far) is the kernel level rootkit (stealth capabilities). All the other features seem pretty simple to emulate for Linux.
media.defense.gov/2020/Aug/13/20…
media.defense.gov/2020/Aug/13/20…
There are 4 modules: server, client, kernel-module, and agent. I like how they differentiate between client and agent where the agent does not include the kernel-module and is more for relaying and data staging. The server uses MySQL back-end, similar to other C2 frameworks.
"The name Drovorub comes from a variety of artifacts discovered in Drovorub files and from operations
conducted by the GTsSS using this malware; it is the name used by the GTsSS actors themselves. Taken together,
they translate to “woodcutter” or “to split wood.”
conducted by the GTsSS using this malware; it is the name used by the GTsSS actors themselves. Taken together,
they translate to “woodcutter” or “to split wood.”
Server is configured like a typical C2 server, there is key exchange, and it seems to be a JSON formatted plain text configuration files. There is an initial signin for registering client and then signin afterwards. Paper goes deep into C2 functionality. #C2Matrix 
Host Communication section on page 33 of PDF (27 of paper) is where it covers how the kernel-module works to hide on the host. (communicate over a designated pseudo-device (e.g. /dev/zero) that is not traditionally used for bi-directional, full duplex input/output (I/O).
Extensive section on detection (use outbound proxy, review network communication, yara, snort, etc.) and prevention (apply patches, prevent untrusted/unsigned kernel modules) following industry best practices most of us know to do already. Good that FBI/NSA called out GRU. /fin
