DrovorubMalware
Drovorub is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has been used by APT28.From MITRE ATT&CK
Last reported 7 months ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1552.004Private Keys
“…lities in WSL can make it easier for attackers to find and steal credentials where developers are using WSL, for example for AWS, RSA private keys, and shared environment variables (i.e., WSLENV).”
- T1684Social Engineering
“This involves social engineering to get them to install and run a malicious package.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The Evolving Linux Threat Landscape“Malware such as Wolfsbane and Drovorub are indicative of attacks that have spanned over 15 years.”
Thanks — we review every report.