Drovorub (Russian: дроворуб, "woodcutter") is a for developing malware for the Linux operating system. It was created by the , a unit of the Russian GRU often referred to as APT28. Drovorub has a sophisticated modular architecture, containing an coupled with a , a file transfer and port forwarding tool, and a command and control server. Drovorub has been described as a "Swiss-army knife for hacking Linux". The U.S. government report that first identified Drovorub recommends the use of UEFI Secure Boot and Linux's native facility to resist Drovorub attacks.