4 ms·
>In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS oper
by fuoqi 6y ago
>In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS operational cyber infrastructure
Publicly known GRU malware C&C infrastructure??? If it's became "public", wouldn't they move from it immediately? Also I guess evil GRU hackers are too stupid to use technologies like I2P, Tor, or even something simpler like Bitmessage and route control traffic via botnets of hacked routers and IoT appliances.
>The name Drovorub comes from a variety of artifacts discovered in Drovorub files and from operations conducted by the GTsSS using this malware
So they again found some Cyrillic letters in binary dumps and used it for attribution? Can we download those artifacts and see for ourselves? Or should we simply trust gentleman's word?
And if I haven't missed something the report contains a lot of unimportant noise, but fails to explain how this malware gets into systems in the first place.
- whatshisface 6y ago>So they again found some Cyrillic letters in binary dumps and used it for attribution? Yeah, these always get me, you see attribution almost every time an alphabet agency goes to the media with malware they analyzed, but it's never reported to be more sophisticated than "a д showed up in the hex dump."
- Craighead 6y agoYou understand that a variety of artifacts isn't the same thing as "some Cryillic letters" right?
- colek42 6y agoAttribution probably gets into some classified tradecraft most of the time.
- whatshisface 6y agoAhh yes, the "inverse conspiracy theory." The government is secretly competent. ;)
- deleted 6y ago[deleted]
- enkid 6y agoRead the article. Microsoft published details about an attack from April 2019 using an IP. This malware used the same IP for a different attack, also in April 2019.
- chromedev 6y agoA single IP address? Really?
- enkid 6y agoHere are the contents of the "attribution section:" "Drovorub is proprietary malware developed for use by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165. GTsSS malicious cyber activity has previously been attributed by the private sector using the names Fancy Bear, APT28, Strontium, and a variety of other identifiers. (Department of Justice, 2018) (Washington Post, 2018) (CrowdStrike, 2016) In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS operational cyber infrastructure. For one example, on August 5, 2019, Microsoft Security Response Center published information linking IP address 82.118.242.171 to Strontium infrastructure in connection with the exploitation of Internet of Things (IoT) devices in April 2019. (Microsoft Security Response Center, 2019) (Microsoft, 2019) NSA and FBI have confirmed that this same IP address was also used to access the Drovorub C2 IP address 185.86.149.125 in April 2019." So unless they were sharing 185.86.149.125 with a different malware group (in addition to the other indications that are not mentioned), this seems like pretty good evidence that they share attribution.
- chromedev 6y agoMy bad, I was under the impression that they were trying to say the attack came from a single IP address only.