Thursday, March 28, 2024

HIDDEN COBRA – A North Korean Hacking Group Attack in Wide using Powerful RAT & SMB Worm -Warned DHS & FBI

HIDDEN COBRA is one of the well known hacking group who is behind the North Korean government spreading Powerful Joanap Backdoor and  Brambul Server Message Block Worm across the globe.

DHS & FBI has been issued a warning about this cyber attack across the US including the government IT infrastructure.

HIDDEN COBRA used IP addresses and related Indicator of Compromise that linked with two malware family that used by the North Korean government.

Joanap, A Remote access trojan and another malware called Brambul which is used as a Server Message Block (SMB) worm.

Joanap and Brambul malware used by HIDDEN COBRA since 2009 which attacked many of the victims globally and in the United States—including the media, aerospace, financial, and critical infrastructure sectors.

HIDDEN COBRA using various IP address to maintain a presence on victims machine and performing a powerful exploitation on the victim’s network.

DHS & FBI is released all the IOC’s to protect the network and keep the network and other possible attack vectors to any North Korean hackers cyber activity.

Along with the IOC’s, FBI also gave the recommended mitigation techniques and information on how to report incidents and DHS request to, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch) if they experienced the actvities by any of these IOC.

Joanap Remote Access tool 

Joanna is a powerful backdoor that has an ability to exfiltrate data, drop and run secondary payloads, and initialize proxy communications within the compromised victim’s computer.

Also, it acts as Remote access Trojan that is able to receive the command remotely from HIDDEN COBRA actors through command & control server.

Joanap dropped from other Malware, compromise website by HIDDEN COBRA actors and malicious Email attachment.

According to us-cert, Analysis indicates the malware encodes data using Rivest Cipher 4 encryption to protect its communication with HIDDEN COBRA actors. HIDDEN COBRA actors use this file to capture and store victims’ information such as the host IP address, hostname, and the current system time.

U.S. Government identified 87 compromised network nodes. infected IP addresses are identified from following countries.

Brambul SMB Worm

Brambul is a malicious worm that mainly targeting Windows 32-bit SMB and the dropper will deploy the Brambul on victims computer via service dynamic link library file or a portable executable file.

Once it executes onto the victim machine then it will try to establish the connection with the subnet of the infected machine and connected with all the Local network.

After the success of network access, it attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks.

Later  This information includes the IP address and hostname—as well as the username and password—of each victim’s system. HIDDEN COBRA actors can use this information to remotely access a compromised system via the SMB protocol.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles