H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Drovorub

[Drovorub](https://attack.mitre.org/software/S0502) is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has been used by [APT28](https://attack.mitre.org/groups/G0007).(Citation: NSA/FBI Drovorub August 2020)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Drovorub](https://attack.mitre.org/software/S0502) is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has been used by [APT28](https://attack.mitre.org/groups/G0007).(Citation: NSA/FBI Drovorub August 2020)

Labels

malware
13 recorded

Relationships

uses
from APT28
Group
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Internal Proxy
Technique
uses
to Kernel Modules and Extensions
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Rootkit
Technique
uses
to Unix Shell
Technique
uses
to Web Protocols
Technique
2 external

References

mitre-attack
S0502
open
NSA/FBI Drovorub August 2020
https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance