NSA, FBI Expose Russian Intelligence Hacking Tool

The U.S. National Security Agency and Federal Bureau of Investigation have exposed a sophisticated Russian hacking tool, they said on Thursday in a rare public report offering new insight on Russia's arsenal of digital weapons.

The NSA and FBI said that Russia's Main Intelligence Directorate, known as the GRU, was using a hacking tool code named "Drovorub" to break into Linux-based computers. Linux is an operating system commonly used across computer server infrastructure.

The public call-out is unique, said a former Western intelligence official, because of the direct attribution offered by the U.S. agencies. The NSA and FBI connected Drovorub to a specific Russian intelligence team - the 85th Main Special Service Center (GTsSS), military unit 26165.

The GTsSS, the agencies said, is associated with the same hackers who broke into the Democratic National Committee in 2016.

“Drovorub is a ‘Swiss Army knife’ of capabilities that allows the attacker to perform many different functions, such as stealing files and remote-controlling the victim’s computer," said Steve Grobman, chief technology officer for cybersecurity company McAfee.

Thursday's highly technical, 45-page NSA/FBI report is the latest in a series of public call-outs by the U.S government aimed at Russian hacking operations ahead of the 2020 U.S. presidential election. The agencies did not say what types of organizations had been compromised by Drovorub.

The NSA and FBI did not immediately respond to a request for comment.