สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Drovorub

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Drovorub

Names	Drovorub
Category	Malware
Type	Rootkit, Backdoor, Exfiltration, Tunneling
Description	(NSA/FBI) Drovorub is a Linux malware toolset consisting of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server. When deployed on a victim machine, the Drovorub implant (client) provides the capability for direct communications with actor-controlled C2 infrastructure; file download and upload capabilities; execution of arbitrary commands as 'root'; and port forwarding of network traffic to other hosts on the network.
Information	<https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF> <https://www.mcafee.com/blogs/other-blogs/mcafee-labs/on-drovorub-linux-kernel-security-best-practices/>
MITRE ATT&CK	<https://attack.mitre.org/software/S0502/>

Last change to this tool card: 30 December 2022

Download this tool card in JSON format

Previous: DropPhone
Next: Drupalgeddon

All groups using tool Drovorub

Changed	Name	Country	Observed
APT groups
	Sofacy, APT 28, Fancy Bear, Sednit		2004-Apr 2025

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]