Drovorub (Russian:дроворуб, "woodcutter") is a software toolkit for developingmalware for theLinux operating system. It was created by the85th Main Special Service Center, a unit of the RussianGRU often referred to asAPT28.[1][2]
Drovorub has a sophisticated modular architecture,[3] containing an implant coupled with a kernel module rootkit, afile transfer andport forwarding tool, and acommand and control server.[2] Drovorub has been described as a "Swiss-army knife for hacking Linux".[4]
The U.S. government report that first identified Drovorub recommends the use ofUEFI Secure Boot and Linux's native kernel module signing facility to resist Drovorub attacks.[5]
