U.S. Warns of North Korea's 'Hidden Cobra' Attacks

ronjor · Oct 31, 2019

North Korean Malicious Cyber Activity

Original release date: October 31, 2019
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) have identified a Trojan malware variant—referred to as HOPLIGHT—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
CISA encourages users and administrators to review Malware Analysis Reports MAR-10135536-8 and the page on HIDDEN COBRA - North Korean Malicious Cyber Activity for more information.
Click to expand...

ronjor · Feb 14, 2020

North Korean Malicious Cyber Activity
Original release date: February 14, 2020

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) have identified the following malware variants used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.

HOPLIGHT (update)
BISTROMATH
SLICKSHOES
HOTCROISSANT
ARTFULPIE
BUFFETLINE
CROWDEDFLOUNDER

CISA encourages users and administrators to review the Malware Analysis Reports for each malware variant listed above and the North Korean Malicious Cyber Activity page for more information.
Click to expand...

guest · Apr 15, 2020

Guidance on the North Korean Cyber Threat
Alert (AA20-106A)
April 15, 2020
https://www.us-cert.gov/ncas/alerts/aa20-106a

The U.S. Departments of State, the Treasury, and Homeland Security, and the Federal Bureau of Investigation are issuing this advisory as a comprehensive resource on the North Korean cyber threat for the international community, network defenders, and the public. The advisory highlights the cyber threat posed by North Korea – formally known as the Democratic People’s Republic of Korea (DPRK) – and provides recommended steps to mitigate the threat. In particular, Annex 1 lists U.S. government resources related to DPRK cyber threats and Annex 2 includes a link to the UN 1718 Sanctions Committee (DPRK) Panel of Experts reports.

In particular, the United States is deeply concerned about North Korea’s malicious cyber activities, which the U.S. government refers to as HIDDEN COBRA.
Click to expand...

guest · May 12, 2020

North Korean Malicious Cyber Activity
May 12, 2020
https://www.us-cert.gov/ncas/current-activity/2020/05/12/north-korean-malicious-cyber-activity

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) have identified three malware variants—COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH—used by the North Korean government. In addition, U.S. Cyber Command has released the three malware samples to the malware aggregation tool and repository, VirusTotal. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.

CISA encourages users and administrators to review the Malware Analysis Reports for each malware variant listed above, U.S. Cyber Command’s VirusTotal page, and CISA’s North Korean Malicious Cyber Activity page for more information.
Click to expand...

ronjor · Aug 19, 2020

North Korean Malicious Cyber Activity
Original release date: August 19, 2020

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have identified a malware variant—referred to as BLINDINGCAN—used by North Korean actors.
CISA encourages users and administrators to review Malware Analysis Report MAR-10295134-1.v1 and CISA’s North Korean Malicious Cyber Activity page for more information.
Click to expand...

guest · Aug 26, 2020

North Korean Malicious Cyber Activity: FASTCash
August 26, 2020
https://us-cert.cisa.gov/ncas/curre...orth-korean-malicious-cyber-activity-fastcash

The Cybersecurity Security and Infrastructure Security Agency (CISA), the Department of the Treasury, the Federal Bureau of Investigation, and U.S. Cyber Command have released a joint Technical Alert and three Malware Analysis Reports (MARs) on the North Korean government’s ATM cash-out scheme—referred to by the U.S. Government as “FASTCash.” The U.S. Government refers to the group behind FASTCash as BeagleBoyz, a subset of HIDDEN COBRA.

CISA encourages users and administrators to review the following resources for more information.
Click to expand...

Joint Technical Alert: FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks

MAR-10301706-1.v1: North Korean Malware: ECCENTRICBANDWAGON

MAR-10301706-2.v1: North Korean Malware: VIVACIOUSGIFT

MAR-10257062-1.v2: North Korean Malware: FASTCASH for Windows

North Korean Malicious Cyber Activity page

Click to expand...

ronjor · Oct 27, 2020

North Korean Advanced Persistent Threat Focus: Kimsuky

Original release date: October 27, 2020
This advisory describes known Kimsuky TTPs, as found in open-source and intelligence reporting through July 2020. The target audience for this advisory is commercial sector businesses desiring to protect their networks from North Korean APT activity.
Click to expand...

ronjor · Feb 18, 2021

North Korean Malicious Cyber Activity: AppleJeus

Original release date: February 17, 2021
CISA, the Federal Bureau of Investigation, and the Department of the Treasury have released a Joint Cybersecurity Advisory and seven Malware Analysis Reports (MARs) on the North Korean government’s dissemination of malware that facilitates the theft of cryptocurrency—referred to by the U.S. Government as “AppleJeus.”
Click to expand...

The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
CISA encourages users and administrators to review the following resources for more information.
Click to expand...

Log in or Sign up

U.S. Warns of North Korea's 'Hidden Cobra' Attacks

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

U.S. Warns of North Korea's 'Hidden Cobra' Attacks

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Useful Searches