Friday, April 19, 2024

HIDDEN COBRA – A North Korean Hacking Group Attack in Wide using Powerful RAT & SMB Worm -Warned DHS & FBI

HIDDEN COBRA is one of the well known hacking group who is behind the North Korean government spreading Powerful Joanap Backdoor and  Brambul Server Message Block Worm across the globe.

DHS & FBI has been issued a warning about this cyber attack across the US including the government IT infrastructure.

HIDDEN COBRA used IP addresses and related Indicator of Compromise that linked with two malware family that used by the North Korean government.

Joanap, A Remote access trojan and another malware called Brambul which is used as a Server Message Block (SMB) worm.

Joanap and Brambul malware used by HIDDEN COBRA since 2009 which attacked many of the victims globally and in the United States—including the media, aerospace, financial, and critical infrastructure sectors.

HIDDEN COBRA using various IP address to maintain a presence on victims machine and performing a powerful exploitation on the victim’s network.

DHS & FBI is released all the IOC’s to protect the network and keep the network and other possible attack vectors to any North Korean hackers cyber activity.

Along with the IOC’s, FBI also gave the recommended mitigation techniques and information on how to report incidents and DHS request to, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch) if they experienced the actvities by any of these IOC.

Joanap Remote Access tool 

Joanna is a powerful backdoor that has an ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications within the compromised victim’s computer.

Also, it acts as Remote access Trojan that is able to receive the command remotely from HIDDEN COBRA actors through command & control server.

Joanap dropped from other Malware, compromise website by HIDDEN COBRA actors and malicious Email attachment.

According to us-cert, Analysis indicates the malware encodes data using Rivest Cipher 4 encryption to protect its communication with HIDDEN COBRA actors. HIDDEN COBRA actors use this file to capture and store victims’ information such as the host IP address, hostname, and the current system time.

U.S. Government identified 87 compromised network nodes. infected IP addresses are identified from following countries.

Brambul SMB Worm

Brambul is a malicious worm that mainly targeting Windows 32-bit SMB and the dropper will deploy the Brambul on victims computer via service dynamic link library file or a portable executable file.

Once it executes onto the victim machine then it will try to establish the connection with the subnet of the infected machine and connected with all the Local network.

After the success of network access, it attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks.

Later  This information includes the IP address and hostname—as well as the username and password—of each victim’s system. HIDDEN COBRA actors can use this information to remotely access a compromised system via the SMB protocol.


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles