North Korean Cyber Attacks Continue

The US Department of Homeland Security and FBI issued a new warning this week that North Korean government hackers are continuing to target critical US infrastructure for cyber attacks.

A technical report by DHS' National Cyber Awareness System reveals details of the tools and cyber methods being used by North Korean government hackers.

The alert said the North Korean government is using the cyber tools to "target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally."

The warning comes amid heightened tensions between the United States and North Korea. Pyongyang recently threatened to fire missiles at Guam prompting counter threats from the Trump administration. The notice lists Internet Protocol addresses linked to a malware called DeltaCharlie that is "used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure."

A botnet is a network of a large number of hijacked computers and networks that are used to conduct cyber-attacks designed to shut down networks by flooding them with digital requests.
"The US government refers to the malicious cyber activity by the North Korean government as Hidden Cobra," the notice said.
The technical details were published to assist computer administrators in identifying North Korea Botnet cyber strikes.
"FBI has high confidence that Hidden Cobra actors are using the IP addresses for further network exploitation," the notice said.

The government warning followed a report by the California-based security firm Palo Alto Networks earlier this month indicating that North Korean hackers were targeting US defense contractors.

The hackers sent out emails containing weaponised Microsoft Office documents, including one that used a fraudulent job offering for a position as a manager of the Terminal High Altitude Area Defense, or THAAD, the U.S. anti-missile system recently deployed to South Korea.
"The techniques and tactics the group uses have changed little in recent attacks," Palo Alto Networks stated in a report. "Tool and infrastructure overlaps with previous campaigns are apparent. Given that the threat actors have continued operations despite their discovery and public exposure it is likely they will continue to operate and launch targeted campaigns."
The North Korean Botnet has been operating since 2009 and have compromised "a range of victims" that were not specified by the notice. The latest DHS report provided additional details on the cyber threat from a report first published in June.
"Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the notice said, noting that security experts have identified two entities used as cover names by the North Koreans. They are the Lazarus Group and the Guardians of Peace.

The Guardians of Peace was the code name used by North Korean hackers who attacked Sony Pictures Entertainment in what officials have called one of the first publicly known state-sponsored cyber-attacks. The November 2014 cyber-attack against Sony was aimed at derailing release of the comedy film The Interview that involved a fictional plot to kill North Korean leader Kim Jong Un.

The attack resulted in the destruction of Sony networks and the theft and disclosure of valuable and sensitive internal data.
"DHS and FBI assess that Hidden Cobra actors will continue to use cyber operations to advance their government’s military and strategic objectives," the notice said.

Among the cyber-attack tools used by the North Koreans are botnets, keyloggers, remote access tools, and wiper malware.
Keyloggers are malware capable of remotely intercepting keyboard strokes in learning login and passwords; remote access tools are methods of creating covert openings in networks targeted for attacks; and wiper malware is used to destroy all data on targeted networks. The malware linked to the North Koreans includes variants called Destroyer, Wild Positron/Duuzer, and Hangman. The North Koreans also appear to be targeting networks that use older, unsupported Microsoft operating systems, such as Windows XP.
"The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation," the notice said. "These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users' environments."
The report warned that cyber-attacks can produce severe impacts, especially when sensitive information is stolen and made public.

DHS said that by using software security patches, technically blocking known malware, restricting administrator privileges, and using firewalls, up to 85 percent of cyber intrusions can be halted.
"However, many organisations fail to use these basic security measures, leaving their systems open to compromise," the report said.

Details of the North Korean hacker methods were disclosed by the security firm Novetta in a recent report, "Operation Blockbuster: Destructive Malware Report."
"The destructive malware within the Lazarus Group’s collection ranges from simplistic to moderately advanced in construction and style," the report said.
"The authors behind these destructive malware families have developed a set of tools capable of inflicting significant damage against a target either directly … or remotely. This further emphasises that even a moderately capable adversary with minimal resources is able to perform asymmetric cyberwar against a large target."

Free Beacon:

You Might Also Read: 

N. Korea Will Unleash Cyber Attacks On The US:

Ignoring Software Updates…:

WannaCry Also Hit Windows 7 Systems:

 


 

 

 

 

« Driverless Truck Fleet Gets UK Trial
Solutions To Combat ‘Fake News’ »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Dark Reading

Dark Reading

Dark Reading is the most trusted online community for security professionals.

Snow Software

Snow Software

Snow Software is changing the way organizations think about their technology investments, empowering IT and business leaders to drive transformation with precision and agility.

Attivo Networks

Attivo Networks

Attivo Networks is an award winning provider of deception for in-network threat detection, attack forensic analysis, and continuous threat response.

Owl Cyber Defense

Owl Cyber Defense

Owl patented DualDiode Technology enables hardware-enforced network segmentation and deterministic, one-way transfer of all data types and file sizes.

Epati Information Technologies

Epati Information Technologies

ePati Information Technologies is a specialist in information technology and cyber security.

Secure Code Warrior

Secure Code Warrior

Secure your code from the start with gamified, scalable online secure coding training for software developers.

Ziroh Labs

Ziroh Labs

Ziroh Labs leverages advanced cryptography to keep your highly sensitive, private data safe throughout the lifecycle of data.

Cyber Intelligence 4U

Cyber Intelligence 4U

Cyber Intelligence 4U is an educational services company that provides two levels of cybersecurity training programs: executive and technical.

Injazat

Injazat

Injazat Data Systems is an industry recognized market leader in the Gulf region for Information Technology, Data Center and Managed Services.

ActiveNav

ActiveNav

ActiveNav provide dark data discovery solutions for compliance and information governance.

Raqmiyat

Raqmiyat

Raqmiyat provides end-to-end IT Services and business solutions including consultancy, digital transformation, infrastructure and cybersecurity.

Intaso

Intaso

Intaso are a boutique head hunting and talent solution firm with specialist Cyber and Information Security expertise.

Altospam

Altospam

Altospam is a full service corporate email protection, integrating multiple security levels for your emails.

Beacon Technology

Beacon Technology

Beacon Technology offers a comprehensive platform consisting of XDR, VMDR, and Breach and Attack simulation tools.

Proaxiom

Proaxiom

Proaxiom are focused on erasing cyber driven panic paralysis for Small and Medium Enterprises through brilliant cyber technologies which drive productivity and support growth.

Coastline Cybersecurity

Coastline Cybersecurity

Coastline Cyber is a cybersecurity consulting firm dedicated to helping organizations strengthen their security posture by reducing risks, mitigating threats, and protecting against attacks.

Quantum Squint

Quantum Squint

Quantum Squint is a cutting-edge cybersecurity company specializing in the use of advanced regression management techniques to detect, analyze, and prevent vulnerabilities in digital systems.