US-CERT has issued a joint technical alert from the DHS and the FBI, warning about two new types of malware detected that are being used by the prolific North Korean hacker group known as Hidden Cobra.
Hidden Cobra is believed, often known as Lazarus Group and Guardians of Peace, is backed by the North Korean government and known for launching attacks against media organizations, aerospace, financial and critical infrastructure sectors worldwide.
The group even partnered with the WannaCry ransomware threat that last year shut down hospitals and businesses around the world. Según los informes, is also linked to the Sony Pictures hack 2014, as well as with the SWIFT Banking attack in 2016.
Now, el Departamento de Seguridad Nacional (DHS) and the FBI have discovered two new types of malware that Hidden Cobra has used since at least 2009 to target companies working in the media, aerospace, financial and critical infrastructure sectors worldwide.
The malware that Hidden Cobra is using is: remote access Trojan (RAT) known as Joanap and the server message block worm (SMB) called Brambul. Let's look at the malware details one by one.
Remote Access Trojan Joanap-A
According to the US-CERT alert, Joanap is a two-stage malware that establishes peer-to-peer communications and manages botnets designed to enable other malicious operations.
The malware generally infects the system with a file delivered by other malware, que los usuarios descargan sin saberlo cuando visitan sitios web comprometidos por los actores de Hidden Cobra, o cuando abren archivos adjuntos de correo electrónico maliciosos.
Brambul-An SMB Worm
Brambul es un gusano de autenticación de fuerza bruta que, al igual que el devastador ransomware WannaCry, abusa del protocolo del bloque de mensajes del servidor (SMB) para propagarse a otros sistemas.
“Cuando se ejecuta, el malware intenta establecer contacto con los sistemas de víctimas y las direcciones IP en las subredes locales de las víctimas”, señala la alerta.
“Si tiene éxito, la aplicación intenta obtener acceso no autorizado a través del protocolo SMB (puertos 139 and 445) lanzando ataques de contraseña de fuerza bruta usando una lista de contraseñas incorporadas. In addition, el malware genera direcciones IP aleatorias para futuros ataques”.