By Eduard Kovacs on February 03, 2021
NSA and FBI Released Detailed Information on Drovorub Linux Malware, But Major Cybersecurity Firms Found No Samples
A piece of malware linked by U.S. intelligence agencies to hackers believed to be backed by the Russian government remains a mystery to the private sector, which apparently hasn’t found a single sample of the malware, and one researcher went as far as suggesting that it may be a false flag set up by the United States itself.
In August 2020, the NSA and the FBI released a joint cybersecurity advisory detailing a piece of malware they named Drovorub. According to the agencies, Drovorub was designed to target Linux systems as part of cyber espionage operations conducted by Russia’s General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165, which has been linked to attacks conducted by the threat actor tracked as APT 28, Fancy Bear, Sednit and Strontium.
share
Print
Moscow says it has added several senior German security officials to its list of those barred from the country in response to the European Union s decision to place travel bans on Russian officials over a 2015 hacking attack on the German parliament.
The Russian Foreign Ministry did not name the individuals added to the list on December 29 in the tit-for-tat move, saying the new persons involved in the Russian stop-list have been elected senior officials of the German security and intelligence agencies that are part of the system of the German Defense Ministry.
In October, the European Union and Great Britain imposed sanctions against the head of Russia s GRU military intelligence agency, a unit within the agency, and one of its officers for their involvement in the cyberattack.
Finland s parliament building in Helsinki (Photo: Wikipedia)
Finnish police and parliament officials are investigating a security incident that happened earlier this year in which attackers gained access to internal IT networks and appear to have compromised lawmakers email accounts.
The strike appears to have taken place sometime during the fall and was discovered earlier this month, according to the Finnish Central Criminal Police. Currently, law enforcement officials believe this intrusion is an act of espionage. The act is not accidental. At this stage, one alternative is that unknown [actors] have been able to obtain information through the hacking, either for the benefit of a foreign state or to harm Finland, says Tero Muurman, the crime commissioner from the Finnish Central Criminal Police.
The Norwegian parliament, known as Storting, is located in Oslo.
The Norwegian parliament s investigation into the hacking of email accounts of some elected officials and government employees in August has concluded that a Russia-linked advanced persistent threat group is likely responsible, according to a report issued this week. The investigation shows that it s likely that the operation was carried out by the cyber actor referred to APT28, or Fancy Bear, Norwegian Police Attorney Anne Karoline Bakken Staff noted in a statement this week issued by the country s parliament.
Analysts and security researchers have previously linked APT28 to Russia s Main Intelligence Directorate, commonly referred to as the GRU, which serves as the military intelligence division of Russia s armed forces.