Threat Source newsletter for Aug. 20, 2020
Summary: CISA, CyberCom and the FBI issued a joint statement warning government agencies, contractors and think tanks about a new strain of the Taidoor malware, which masks its communication with a command and control server and carries out espionage activities including file exfiltration. A separate malware strain known as Drovorub, attributed to Russian state-sponsored actors, targets Linux devices with a kernel for persistence and detection avoidance, a C2 server and an agent relaying between infected machines and attacker servers, and CISA says it went undetected until recently.
Why it matters: Two state-linked espionage toolkits are named in the same week - one aimed at government agencies, contractors and think tanks, the other at Linux systems holding sensitive intelligence - and Drovorub's persistence kernel kept it hidden until CISA flagged it.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026