U.S. Warns of North Korea's 'Hidden Cobra' Attacks

itman · Jun 14, 2017

The United States Computer Emergency Readiness Team (US-CERT) released a technical alert on Tuesday on behalf of the DHS and the FBI to warn organizations of North Korea’s “Hidden Cobra” activities, particularly distributed denial-of-service (DDoS) attacks.

The threat actor dubbed by the U.S. government “Hidden Cobra” is better known in the infosec community as Lazarus Group, which is believed to be behind several high-profile attacks, including the ones targeting Sony Pictures, Bangladesh’s central bank, and financial organizations in Poland. Links have also been found between the threat actor and the recent WannaCry ransomware attacks, but some experts are skeptical.

The joint alert from the FBI and the DHS provides indicators of compromise (IoC) associated with a botnet known as “DeltaCharlie.” The North Korean government has allegedly used DeltaCharlie, which has been detailed in Novetta’s “Operation Blockbuster” report, to launch DDoS attacks.

“DeltaCharlie is a DDoS tool capable of launching Domain Name System (DNS) attacks, Network Time Protocol (NTP) attacks, and Character Generation Protocol attacks,” US-CERT said. “The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks.”

US-CERT has shared information on exploits, malware, IP addresses, file hashes, network signatures, and YARA rules associated with Hidden Cobra in an effort to help defenders detect the group’s attacks. However, it noted that “further research is needed to understand the full breadth of this group’s cyber capabilities.”

The agency warned that, in some cases, the DDoS malware was present on victims’ networks for a significant period of time.

Network administrators have been advised to follow a series of recommendations for mitigating attacks and responding to unauthorized network access.
Click to expand...

http://www.securityweek.com/us-warns-north-koreas-hidden-cobra-attacks

ronjor · Nov 14, 2017

HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL

Original release date: November 14, 2017
Systems Affected
Network systems

FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report’s IOC files—to maintain a presence on victims’ networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to any North Korean government malicious cyber activity.
Click to expand...

stapp · Nov 16, 2017

More info
https://www.theregister.co.uk/2017/11/15/hidden_cobra_north_korea_malware_fallchill/

ronjor · Nov 16, 2017

HIDDEN COBRA – North Korean Trojan: Volgmer

Original release date: November 14, 2017 | Last revised: November 15, 2017
Description
Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. Since at least 2013, HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government, financial, automotive, and media industries.
Click to expand...

ronjor · Dec 22, 2017

North Korean Malicious Cyber Activity

Original release date: December 21, 2017
US-CERT encourages users and administrators to review Malware Analysis Report (MAR) 10135536-B and the US-CERT page on HIDDEN COBRA - North Korean Malicious Cyber Activity for more information.
Click to expand...

itman · Dec 22, 2017

ronjor said: ↑

North Korean Malicious Cyber Activity
Click to expand...

One of these RATs uses a cipher and the OpenSSL library to add a layer of encryption to communications between the infected system and its command and control (C2) server; this RAT may have been used to install the proxy servers onto compromised systems.
Click to expand...

https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF

ronjor · Feb 13, 2018

North Korean Malicious Cyber Activity

Original release date: February 13, 2018
The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified Trojan malware variants—referred to as HARDRAIN and BADCALL—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA
Click to expand...

Rmus · Feb 18, 2018

ronjor said: ↑

North Korean Malicious Cyber Activity
Click to expand...

Hi Ron,

Some extra syntax got copied into the URL. It is:

https://www.us-cert.gov/ncas/current-activity/2018/02/13/North-Korean-Malicious-Cyber-Activity

(I couldn't make the insert Link work)

-rich

ronjor · Mar 28, 2018

North Korean Malicious Cyber Activity

Original release date: March 28, 2018
The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified Trojan malware variants—referred to as SHARPKNOT—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
Click to expand...

itman · Mar 28, 2018

[QUOTENorth Korean Malicious Cyber Activity[/QUOTE]
No one on VT detects this.

This malware report contains analysis of a malicious 32-bit Windows executable file. When executed from the command line, the malware overwrites the Master Boot Record (MBR) and deletes files on the local system, any mapped network shares, and physically connected storage devices.
Click to expand...

CloneRanger · Mar 28, 2018

As if the US doesn't do a LOT more similar stuff than them, directed at LOTS of other countries etc !

EASTER · Mar 28, 2018

Well my take it is this. Since there are so many other machines around the planet sporting the beautiful 32 Bit system that it doesn't matter which nation-state it is, many will have plenty enough target systems (32 bit) to get them thru their always busy intrusion plans.

Internet connected devices as a whole is turned this planet into one massive huge electric/battery computer playground for all

Minimalist · Apr 28, 2018

As two Koreas shake hands, Hidden Cobra hackers wage espionage campaign

As Kim Jong Un became the first North Korean leader to step into South Korea, his generals continue to oversee teams of increasingly advanced hackers who are actively targeting the financial, health, and entertainment industries in the US and more than a dozen other countries. The so-called GhostSecret data reconnaissance campaign, exposed Tuesday by security firm McAfee, remains ongoing. It is deploying a series of previously unidentified tools designed to stealthily infect targets and gather data or possibly repeat the same type of highly destructive attacks visited upon Sony Pictures in 2014.
Click to expand...

https://arstechnica.com/tech-policy...hidden-cobra-hackers-wage-espionage-campaign/

EASTER · Apr 28, 2018

Good for McAfee but what's with all the silence from other AV's-PC Security firms or they just now getting their feet wet to this one.

ronjor · May 29, 2018

HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm

Original release date: May 29, 2018
Systems Affected
Network systems
Overview
This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with two families of malware used by the North Korean government:
Click to expand...

ronjor · Jun 14, 2018

AR18-165A: MAR-10135536-12 – North Korean Trojan: TYPEFRAME

Original release date: June 14, 2018
Description
This Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant is known as TYPEFRAME. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
Click to expand...

ronjor · Aug 9, 2018

North Korean Malicious Cyber Activity

Original release date: August 09, 2018

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA
Click to expand...

ronjor · Oct 2, 2018

North Korean Malicious Cyber Activity October 02, 2018

Original release date: October 02, 2018
The Department of Homeland Security, the Department of the Treasury, and the Federal Bureau of Investigation have identified malware and other indicators of compromise used by the North Korean government in an ATM cash-out scheme—referred to by the U.S. Government as “FASTCash.” The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
Click to expand...

Minimalist · Jan 30, 2019

U.S. announces disruption of ‘Joanap’ botnet linked with North Korea

The Justice Department on Wednesday announced a wide-ranging operation to map and disrupt a botnet linked to North Korea that has infected numerous computers across the globe over the last decade.
Click to expand...

https://www.cyberscoop.com/joanap-botnet-north-korea-department-of-justice/

itman · Jan 30, 2019

Minimalist said: ↑

U.S. announces disruption of ‘Joanap’ botnet linked with North Korea
Click to expand...

The longevity of Joanap, which can be detected by antivirus products, is testament to the enduring vulnerability of unpatched systems.

“While the Joanap botnet was identified years ago and can be defeated with antivirus software, we identified numerous unprotected computers that hosted the malware underlying the botnet,” said U.S. Attorney Nicola Hanna.
Click to expand...

ronjor · Apr 10, 2019

North Korean Malicious Cyber Activity Original release date: April 10, 2019

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as HOPLIGHT—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Malware Analysis Report (MAR) MAR-10135536-8 and the page on HIDDEN COBRA - North Korean Malicious Cyber Activity for more information.
Click to expand...

ronjor · May 9, 2019

North Korean Malicious Cyber Activity
Original release date: May 09, 2019

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a malware variant—referred to as ELECTRICFISH—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
Click to expand...

ronjor · Sep 9, 2019

North Korean Malicious Cyber Activity
Original release date: September 09, 2019

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have identified two malware variants—referred to as ELECTRICFISH and BADCALL—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
CISA encourages users and administrators to review the HIDDEN COBRA - North Korean Malicious Cyber Activity page, which contains links to Malware Analysis Reports MAR-10135536-21 and MAR-10135536-10, for more information.
Click to expand...

guest · Sep 10, 2019

MAR-10135536-21 – North Korean Proxy Malware: ELECTRICFISH
September 9, 2019
https://www.us-cert.gov/ncas/analysis-reports/ar19-252b

This Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners, DHS, FBI, and DoD identified proxy malware variants used by the North Korean government - referred to by the U.S. Government as ELECTRICFISH. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA
Click to expand...

guest · Sep 10, 2019

MAR-10135536-10 – North Korean Trojan: BADCALL
September 9, 2019
https://www.us-cert.gov/ncas/analysis-reports/ar19-252a

This Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners, DHS, FBI, and DoD identified Trojan malware variants used by the North Korean government - referred to by the U.S. Government as BADCALL. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
Click to expand...

Log in or Sign up

U.S. Warns of North Korea's 'Hidden Cobra' Attacks

itman Registered Member

ronjor Global Moderator

stapp Global Moderator

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

ronjor Global Moderator

Rmus Exploit Analyst

ronjor Global Moderator

itman Registered Member

CloneRanger Registered Member

EASTER Registered Member

Minimalist Registered Member

EASTER Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

itman Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

Log in or Sign up

U.S. Warns of North Korea's 'Hidden Cobra' Attacks

itman Registered Member

ronjor Global Moderator

stapp Global Moderator

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

ronjor Global Moderator

Rmus Exploit Analyst

ronjor Global Moderator

itman Registered Member

CloneRanger Registered Member

EASTER Registered Member

Minimalist Registered Member

EASTER Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

itman Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

Useful Searches