Monday, July 15, 2024

HIDDEN COBRA – A North Korean Hacking Group Attack in Wide using Powerful RAT & SMB Worm -Warned DHS & FBI

HIDDEN COBRA is one of the well known hacking group who is behind the North Korean government spreading Powerful Joanap Backdoor and  Brambul Server Message Block Worm across the globe.

DHS & FBI has been issued a warning about this cyber attack across the US including the government IT infrastructure.

HIDDEN COBRA used IP addresses and related Indicator of Compromise that linked with two malware family that used by the North Korean government.

Joanap, A Remote access trojan and another malware called Brambul which is used as a Server Message Block (SMB) worm.

Joanap and Brambul malware used by HIDDEN COBRA since 2009 which attacked many of the victims globally and in the United States—including the media, aerospace, financial, and critical infrastructure sectors.

HIDDEN COBRA using various IP address to maintain a presence on victims machine and performing a powerful exploitation on the victim’s network.

DHS & FBI is released all the IOC’s to protect the network and keep the network and other possible attack vectors to any North Korean hackers cyber activity.

Along with the IOC’s, FBI also gave the recommended mitigation techniques and information on how to report incidents and DHS request to, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch) if they experienced the actvities by any of these IOC.

Joanap Remote Access tool 

Joanna is a powerful backdoor that has an ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications within the compromised victim’s computer.

Also, it acts as Remote access Trojan that is able to receive the command remotely from HIDDEN COBRA actors through command & control server.

Joanap dropped from other Malware, compromise website by HIDDEN COBRA actors and malicious Email attachment.

According to us-cert, Analysis indicates the malware encodes data using Rivest Cipher 4 encryption to protect its communication with HIDDEN COBRA actors. HIDDEN COBRA actors use this file to capture and store victims’ information such as the host IP address, hostname, and the current system time.

U.S. Government identified 87 compromised network nodes. infected IP addresses are identified from following countries.

Brambul SMB Worm

Brambul is a malicious worm that mainly targeting Windows 32-bit SMB and the dropper will deploy the Brambul on victims computer via service dynamic link library file or a portable executable file.

Once it executes onto the victim machine then it will try to establish the connection with the subnet of the infected machine and connected with all the Local network.

After the success of network access, it attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks.

Later  This information includes the IP address and hostname—as well as the username and password—of each victim’s system. HIDDEN COBRA actors can use this information to remotely access a compromised system via the SMB protocol.


Latest articles

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...

Malicious NuGet Campaign Tricking Developers To Inject Malicious Code

Hackers often target NuGet as it's a popular package manager for .NET, which developers...

Akira Ransomware Attacking Airline Industry With Legitimate Tools

Airlines often become the target of hackers as they contain sensitive personal and financial...

DarkGate Malware Exploiting Excel Files And SMB File Shares

DarkGate, a Malware-as-a-Service (MaaS) platform, experienced a surge in activity since September 2023, employing...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles