A piece of malware linked by U.S. intelligence agencies to hackers believed to be backed by the Russian government remains a mystery to the private sector, which apparently hasn’t found a single sample of the malware, and one researcher went as far as suggesting that it may be a false flag set up by the United States itself.

In August 2020, the NSA and the FBI released a joint cybersecurity advisory detailing a piece of malware they named Drovorub. According to the agencies, Drovorub was designed to target Linux systems as part of cyber espionage operations conducted by Russia’s General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165, which has been linked to attacks conducted by the threat actor tracked as APT 28, Fancy Bear, Sednit and Strontium.

The 45-page report released by the NSA and FBI describes Drovorub as a “Linux malware toolset” that consists of an implant with a kernel module rootkit, a file transfer and port forwarding tool, and a command and control (C&C) server.

“When deployed on a victim machine, the Drovorub implant (client) provides the capability for direct communications with actor-controlled C2 infrastructure; file download and upload capabilities; execution of arbitrary commands as ‘root’; and port forwarding of network traffic to other hosts on the network,” the agencies wrote in their advisory.

The advisory shares information on how Drovorub works, how it can be detected, and how organizations can protect their systems against attacks involving the malware.

While you’ve been distracted by the holidays, coronavirus, and politics, the more we learn about the SolarWinds security fiasco, the worse it looks.

SolarWinds cybersecurity expert Ian Thornton-Trump warned the company to improve its internal security to prevent a ‘catastrophic’ episode in 2017
When his recommendations were ignored, he left the firm a month later
US officials say Russian hackers were behind the massive attack that affected more than 250 federal agencies and businesses
The hack is believed to have started as early as October 2019
Employees say SolarWinds CEO Kevin Thompson cut common security practices to save costs and his approach almost tripled SolarWinds’ annual profit margins
Some engineering offices were moved to Eastern Europe, where the Orion software, which was compromised by the hackers, was partially developed