3 ms·
A single IP address? Really?
by chromedev 6y ago
A single IP address? Really?
- enkid 6y agoHere are the contents of the "attribution section:" "Drovorub is proprietary malware developed for use by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165. GTsSS malicious cyber activity has previously been attributed by the private sector using the names Fancy Bear, APT28, Strontium, and a variety of other identifiers. (Department of Justice, 2018) (Washington Post, 2018) (CrowdStrike, 2016) In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS operational cyber infrastructure. For one example, on August 5, 2019, Microsoft Security Response Center published information linking IP address 82.118.242.171 to Strontium infrastructure in connection with the exploitation of Internet of Things (IoT) devices in April 2019. (Microsoft Security Response Center, 2019) (Microsoft, 2019) NSA and FBI have confirmed that this same IP address was also used to access the Drovorub C2 IP address 185.86.149.125 in April 2019." So unless they were sharing 185.86.149.125 with a different malware group (in addition to the other indications that are not mentioned), this seems like pretty good evidence that they share attribution.
- chromedev 6y agoMy bad, I was under the impression that they were trying to say the attack came from a single IP address only.