Discord Server Red Security Twitter Donation to Red Security Red Security Youtube Channel Red Security Tumblr Profile
Login or Register to Hide ads and Accessing all features on the forum

News 

FBI Discover New Malware Connected to Hidden Cobra

0 Replies, 1363 Views

US security agencies have discover two new malware linked to Hidden Cobra, a hacker group linked to North Korea. This name may sound familiar, the groups also goes by Lazarus Group, or the Guardians of Peace. A hacker group backed by the North Korean government. This is the same group that was responsible for the WannaCry hack last year, that crippled hospitals in the US and the UK. It was also reportedly stated that this group was also involved with the Sony Pictures hack back in 2014.

The two new malware, a RAT [Remote Access Tool] named "Joanap" and a SMB [Server Message Block] worm known as "Brambul". It is reported that these malware have been operational since 2009, and have mainly targeted media, aerospace, financial and critical infrastructure all over the world. 

The details of these malware are as follows: [I decided to copy/paste the details as it was too much to summarize, and I want you to have all the information.]

"Joanap—A Remote Access Trojan


According to the US-CERT alert, "fully functional RAT" Joanap is a two-stage malware that establishes peer-to-peer communications and manages botnets designed to enable other malicious operations.

The malware typically infects a system as a file delivered by other malware, which users unknowingly download either when they visit websites compromised by the Hidden Cobra actors, or when they open malicious email attachments.

Joanap receives commands from a remote command and control server controlled by the Hidden Cobra actors, giving them the ability to steal data, install and run more malware, and initialize proxy communications on a compromised Windows device.

Other functionalities of Joanap include file management, process management, creation and deletion of directories, botnet management, and node management.

During analysis of the Joanap infrastructure, the U.S. government has found the malware on 87 compromised network nodes in 17 countries including Brazil, China, Spain, Taiwan, Sweden, India, and Iran."

"Brambul—An SMB Worm


Brambul is a brute-force authentication worm that like the devastating WannaCry ransomware, abuses the Server Message Block (SMB) protocol in order to spread itself to other systems.

The malicious Windows 32-bit SMB worm functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims' networks by dropper malware.
Quote:
"When executed, the malware attempts to establish contact with victim systems and IP addresses on victims' local subnets," the alert notes. 
Quote:
"If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks."
Once Brambul gains unauthorized access to the infected system, the malware communicates information about victim's systems to the Hidden Cobra hackers using email. The information includes the IP address and hostname—as well as the username and password—of each victim's system.

The hackers can then use this stolen information to remotely access the compromised system via the SMB protocol. The actors can even generate and execute what analysts call a "suicide script."

DHS and FBI have also provided downloadable lists of IP addresses with which the Hidden Cobra malware communicates and other IOCs, to help you block them and enable network defenses to reduce exposure to any malicious cyber activity by the North Korean government.

DHS also recommended users and administrators to use best practices as preventive measures to protect their computer networks, like keeping their software and system up to date, running Antivirus software, turning off SMB, forbidding unknown executables and software applications.

Last year, the DHS and the FBI published an alert describing Hidden Cobra malware, called Delta Charlie—a DDoS tool which they believed North Korea uses to launch distributed denial-of-service (DDoS) attacks against its targets.

Other malware linked to Hidden Cobra in the past include Destover, Wild Positron or Duuzer, and Hangman with sophisticated capabilities, like DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware."



---Sh7nk-Z0id
01001001 00100000 01000001 01001101 00100000 01011010 01001111 01000100 01001001 01000001 01000011

Possibly Related Threads…
Thread Author Replies Views Last Post
Star News Top anti-virus, anti-malware products contain security flaws News 0 1,905 10-08-2020, 01:09 AM
Last Post: News
Shocked News Dark_nexus botnet outstrips other malware with new, potent features Mr.Kurd 0 1,776 04-08-2020, 08:52 AM
Last Post: Mr.Kurd
Exclamation News Hackers Deliver LimeRAT Malware Using Password Protected Excel Spreadsheet’s Mr.Kurd 0 1,635 04-01-2020, 11:17 AM
Last Post: Mr.Kurd
Rainbow News Tekya Clicker Malware Hides in 56 Apps that Downloaded 1 Million Times on GooglePlay Mr.Kurd 0 1,557 03-27-2020, 11:47 AM
Last Post: Mr.Kurd
Question News New Android Cookie-Stealing Malware Found Hijacking Facebook Accounts Mr.Kurd 0 1,518 03-13-2020, 11:15 AM
Last Post: Mr.Kurd
Wink News Hackers Hijack Windows 10 RDP ActiveX Control To Download TrickBot Malware Mr.Kurd 0 1,534 03-01-2020, 03:32 PM
Last Post: Mr.Kurd
Wink News Raccoon malware affects all browsers Mr.Kurd 0 1,458 02-29-2020, 07:29 AM
Last Post: Mr.Kurd
Wink News Coronavirus – hackers exploit fear of infection to spread malware Mr.Kurd 0 1,618 02-03-2020, 05:30 PM
Last Post: Mr.Kurd
Brick News Evil Corp Returns With New Malware Infection Tactic Mr.Kurd 0 1,885 02-01-2020, 08:54 AM
Last Post: Mr.Kurd
Exclamation News 1,700 Android apps infected with Bread (Joker) malware since 2017 Mr.Kurd 0 1,508 01-10-2020, 12:00 PM
Last Post: Mr.Kurd



Users browsing this thread: 1 Guest(s)