HIDDEN COBRA is one of the well known hacking group who is behind the North Korean government spreading Powerful Joanap Backdoor and  Brambul Server Message Block Worm across the globe.

DHS & FBI has been issued a warning about this cyber attack across the US including the government IT infrastructure.

HIDDEN COBRA used IP addresses and related Indicator of Compromise that linked with two malware family that used by the North Korean government.

Joanap, A Remote access trojan and another malware called Brambul which is used as a Server Message Block (SMB) worm.

Joanap and Brambul malware used by HIDDEN COBRA since 2009 which attacked many of the victims globally and in the United States—including the media, aerospace, financial, and critical infrastructure sectors.

HIDDEN COBRA using various IP address to maintain a presence on victims machine and performing a powerful exploitation on the victim’s network.

DHS & FBI is released all the IOC’s to protect the network and keep the network and other possible attack vectors to any North Korean hackers cyber activity.

Along with the IOC’s, FBI also gave the recommended mitigation techniques and information on how to report incidents and DHS request to, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch) if they experienced the actvities by any of these IOC.

TA18-149A: HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm https://t.co/T2QO8GgV5U

— CISA Cyber (@CISACyber) May 29, 2018

Joanap Remote Access tool 

Joanna is a powerful backdoor that has an ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications within the compromised victim’s computer.

Also, it acts as Remote access Trojan that is able to receive the command remotely from HIDDEN COBRA actors through command & control server.

Joanap dropped from other Malware, compromise website by HIDDEN COBRA actors and malicious Email attachment.

According to us-cert, Analysis indicates the malware encodes data using Rivest Cipher 4 encryption to protect its communication with HIDDEN COBRA actors. HIDDEN COBRA actors use this file to capture and store victims’ information such as the host IP address, hostname, and the current system time.

U.S. Government identified 87 compromised network nodes. infected IP addresses are identified from following countries.

Brambul SMB Worm

Brambul is a malicious worm that mainly targeting Windows 32-bit SMB and the dropper will deploy the Brambul on victims computer via service dynamic link library file or a portable executable file.

Once it executes onto the victim machine then it will try to establish the connection with the subnet of the infected machine and connected with all the Local network.

After the success of network access, it attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks.

Later  This information includes the IP address and hostname—as well as the username and password—of each victim’s system. HIDDEN COBRA actors can use this information to remotely access a compromised system via the SMB protocol.