Saturday, May 24, 2025
HomeBackdoorHIDDEN COBRA - A North Korean Hacking Group Attack in Wide using...

HIDDEN COBRA – A North Korean Hacking Group Attack in Wide using Powerful RAT & SMB Worm -Warned DHS & FBI

Published on

SIEM as a Service

Follow Us on Google News

HIDDEN COBRA is one of the well known hacking group who is behind the North Korean government spreading Powerful Joanap Backdoor and  Brambul Server Message Block Worm across the globe.

DHS & FBI has been issued a warning about this cyber attack across the US including the government IT infrastructure.

HIDDEN COBRA used IP addresses and related Indicator of Compromise that linked with two malware family that used by the North Korean government.

- Advertisement - Google News

Joanap, A Remote access trojan and another malware called Brambul which is used as a Server Message Block (SMB) worm.

Joanap and Brambul malware used by HIDDEN COBRA since 2009 which attacked many of the victims globally and in the United States—including the media, aerospace, financial, and critical infrastructure sectors.

HIDDEN COBRA using various IP address to maintain a presence on victims machine and performing a powerful exploitation on the victim’s network.

DHS & FBI is released all the IOC’s to protect the network and keep the network and other possible attack vectors to any North Korean hackers cyber activity.

Along with the IOC’s, FBI also gave the recommended mitigation techniques and information on how to report incidents and DHS request to, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch) if they experienced the actvities by any of these IOC.

Joanap Remote Access tool 

Joanna is a powerful backdoor that has an ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications within the compromised victim’s computer.

Also, it acts as Remote access Trojan that is able to receive the command remotely from HIDDEN COBRA actors through command & control server.

Joanap dropped from other Malware, compromise website by HIDDEN COBRA actors and malicious Email attachment.

According to us-cert, Analysis indicates the malware encodes data using Rivest Cipher 4 encryption to protect its communication with HIDDEN COBRA actors. HIDDEN COBRA actors use this file to capture and store victims’ information such as the host IP address, hostname, and the current system time.

U.S. Government identified 87 compromised network nodes. infected IP addresses are identified from following countries.

Brambul SMB Worm

Brambul is a malicious worm that mainly targeting Windows 32-bit SMB and the dropper will deploy the Brambul on victims computer via service dynamic link library file or a portable executable file.

Once it executes onto the victim machine then it will try to establish the connection with the subnet of the infected machine and connected with all the Local network.

After the success of network access, it attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks.

Later  This information includes the IP address and hostname—as well as the username and password—of each victim’s system. HIDDEN COBRA actors can use this information to remotely access a compromised system via the SMB protocol.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to...

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code...

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager...

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

GenAI Assistant DIANNA Uncovers New Obfuscated Malware

Deep Instinct’s GenAI-powered assistant, DIANNA, has identified a sophisticated new malware strain dubbed BypassERWDirectSyscallShellcodeLoader. This...

New Formjacking Malware Targets E-Commerce Sites to Steal Credit Card Data

A disturbing new formjacking malware has emerged, specifically targeting WooCommerce-based e-commerce sites to steal...