Thread by @cyber_watchers

We tweeted in July about the development of a variant to the malware project Drovorub-A1 by Russian tech company AST (АСТ).

https://twitter.com/cyber_watchers/status/1547561370899558400?s=20&t=wsxe2Z21g7Pw9Cr0MMnTAg

Drovorub-A1 was originally developed for the GRU 85th Main Special Service Center (85th GTsSS, в/ч 26165) and dubbed the 'Swiss Army Knife' for hacking Linux.
#APT28 #GRU #FANCYBEAR

US agencies warned of the threat posed in a 45-page security alert released in August 2020 and companies such as Schneider Electric offered mitigation to customers in advance of fixes to their operating systems.
media.defense.gov/2020/Aug/13/20…

According to Moor Insight and Strategy, a leading global technology analyst, there have been no published attacks from the malware and the released security report probably massively affected its operational effectiveness.

Apparently, the variant project, Drovorub-A1-PM, was due to begin in September 2018, but was delayed for several months due to bureaucratic incompetence. Completion was eventually expected in November 2021, however the 5-phase project had been beset with delays.

Over 3 years of development, the project has cost 54.7 million rubles (approx 900,000 USD). Given that AST also received 20 million rubles as part of the INCONTROLLER project development, it seems that AST has not provided much value for money to the GRU.

@threadreaderapp unroll