Comment by fuoqi | Hacker News Reader

Comment by fuoqi | Hacker News Reader

>In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS operational cyber infrastructure

Publicly known GRU malware C&C infrastructure??? If it's became "public", wouldn't they move from it immediately? Also I guess evil GRU hackers are too stupid to use technologies like I2P, Tor, or even something simpler like Bitmessage and route control traffic via botnets of hacked routers and IoT appliances.

>The name Drovorub comes from a variety of artifacts discovered in Drovorub files and from operations conducted by the GTsSS using this malware

So they again found some Cyrillic letters in binary dumps and used it for attribution? Can we download those artifacts and see for ourselves? Or should we simply trust gentleman's word?

And if I haven't missed something the report contains a lot of unimportant noise, but fails to explain how this malware gets into systems in the first place.

>So they again found some Cyrillic letters in binary dumps and used it for attribution?

Yeah, these always get me, you see attribution almost every time an alphabet agency goes to the media with malware they analyzed, but it's never reported to be more sophisticated than "a д showed up in the hex dump."

Attribution probably gets into some classified tradecraft most of the time.

Ahh yes, the "inverse conspiracy theory." The government is secretly competent. ;)

Read the article. Microsoft published details about an attack from April 2019 using an IP. This malware used the same IP for a different attack, also in April 2019.

A single IP address? Really?

Here are the contents of the "attribution section:"

"Drovorub is proprietary malware developed for use by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165. GTsSS malicious cyber activity has previously been attributed by the private sector using the names Fancy Bear, APT28, Strontium, and a variety of other identifiers. (Department of Justice, 2018) (Washington Post, 2018) (CrowdStrike, 2016)

In addition to NSA's and FBI's attribution to GTsSS, operational Drovorub command and control infrastructure has been associated with publicly known GTsSS operational cyber infrastructure. For one example, on August 5, 2019, Microsoft Security Response Center published information linking IP address 82.118.242.171 to Strontium infrastructure in connection with the exploitation of Internet of Things (IoT) devices in April 2019. (Microsoft Security Response Center, 2019) (Microsoft, 2019) NSA and FBI have confirmed that this same IP address was also used to access the Drovorub C2 IP address 185.86.149.125 in April 2019."

So unless they were sharing 185.86.149.125 with a different malware group (in addition to the other indications that are not mentioned), this seems like pretty good evidence that they share attribution.

My bad, I was under the impression that they were trying to say the attack came from a single IP address only.

Reply on news.ycombinator.com