North Korean Cyber Attacks Continue

The US Department of Homeland Security and FBI issued a new warning this week that North Korean government hackers are continuing to target critical US infrastructure for cyber attacks.

A technical report by DHS' National Cyber Awareness System reveals details of the tools and cyber methods being used by North Korean government hackers.

The alert said the North Korean government is using the cyber tools to "target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally."

The warning comes amid heightened tensions between the United States and North Korea. Pyongyang recently threatened to fire missiles at Guam prompting counter threats from the Trump administration. The notice lists Internet Protocol addresses linked to a malware called DeltaCharlie that is "used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure."

A botnet is a network of a large number of hijacked computers and networks that are used to conduct cyber-attacks designed to shut down networks by flooding them with digital requests.
"The US government refers to the malicious cyber activity by the North Korean government as Hidden Cobra," the notice said.
The technical details were published to assist computer administrators in identifying North Korea Botnet cyber strikes.
"FBI has high confidence that Hidden Cobra actors are using the IP addresses for further network exploitation," the notice said.

The government warning followed a report by the California-based security firm Palo Alto Networks earlier this month indicating that North Korean hackers were targeting US defense contractors.

The hackers sent out emails containing weaponised Microsoft Office documents, including one that used a fraudulent job offering for a position as a manager of the Terminal High Altitude Area Defense, or THAAD, the U.S. anti-missile system recently deployed to South Korea.
"The techniques and tactics the group uses have changed little in recent attacks," Palo Alto Networks stated in a report. "Tool and infrastructure overlaps with previous campaigns are apparent. Given that the threat actors have continued operations despite their discovery and public exposure it is likely they will continue to operate and launch targeted campaigns."
The North Korean Botnet has been operating since 2009 and have compromised "a range of victims" that were not specified by the notice. The latest DHS report provided additional details on the cyber threat from a report first published in June.
"Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the notice said, noting that security experts have identified two entities used as cover names by the North Koreans. They are the Lazarus Group and the Guardians of Peace.

The Guardians of Peace was the code name used by North Korean hackers who attacked Sony Pictures Entertainment in what officials have called one of the first publicly known state-sponsored cyber-attacks. The November 2014 cyber-attack against Sony was aimed at derailing release of the comedy film The Interview that involved a fictional plot to kill North Korean leader Kim Jong Un.

The attack resulted in the destruction of Sony networks and the theft and disclosure of valuable and sensitive internal data.
"DHS and FBI assess that Hidden Cobra actors will continue to use cyber operations to advance their government’s military and strategic objectives," the notice said.

Among the cyber-attack tools used by the North Koreans are botnets, keyloggers, remote access tools, and wiper malware.
Keyloggers are malware capable of remotely intercepting keyboard strokes in learning login and passwords; remote access tools are methods of creating covert openings in networks targeted for attacks; and wiper malware is used to destroy all data on targeted networks. The malware linked to the North Koreans includes variants called Destroyer, Wild Positron/Duuzer, and Hangman. The North Koreans also appear to be targeting networks that use older, unsupported Microsoft operating systems, such as Windows XP.
"The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation," the notice said. "These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users' environments."
The report warned that cyber-attacks can produce severe impacts, especially when sensitive information is stolen and made public.

DHS said that by using software security patches, technically blocking known malware, restricting administrator privileges, and using firewalls, up to 85 percent of cyber intrusions can be halted.
"However, many organisations fail to use these basic security measures, leaving their systems open to compromise," the report said.

Details of the North Korean hacker methods were disclosed by the security firm Novetta in a recent report, "Operation Blockbuster: Destructive Malware Report."
"The destructive malware within the Lazarus Group’s collection ranges from simplistic to moderately advanced in construction and style," the report said.
"The authors behind these destructive malware families have developed a set of tools capable of inflicting significant damage against a target either directly … or remotely. This further emphasises that even a moderately capable adversary with minimal resources is able to perform asymmetric cyberwar against a large target."

Free Beacon:

You Might Also Read: 

N. Korea Will Unleash Cyber Attacks On The US:

Ignoring Software Updates…:

WannaCry Also Hit Windows 7 Systems:

 


 

 

 

 

« Driverless Truck Fleet Gets UK Trial
Solutions To Combat ‘Fake News’ »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

GFI Software

GFI Software

GFI Software works with System Administrators, IT Professionals and IT Executives to ensure that their IT infrastructures are monitored, managed, secured and compliant.

Cyfor

Cyfor

Cyfor provides digital forensics and eDiscovery in civil, criminal, intellectual property, litigation and dispute resolution investigations.

Zentera Systems

Zentera Systems

Zentera's CoIP (Cloud over IP) solution offers enterprise-grade networking and security for the emerging cloud ecosystem.

Critical Infrastructures for Information and Cybersecurity (ICIC)

Critical Infrastructures for Information and Cybersecurity (ICIC)

ICIC addresses the demand for cybersecurity for National Public Sector organizations and civil and private sector organizations in Argentina.

Telecom Information Sharing and Analysis Center Japan (T-ISAC Japan)

Telecom Information Sharing and Analysis Center Japan (T-ISAC Japan)

T-ISAC Japan coordinates information sharing and activities related to ISP/telecommunications network security in Japan.

DeviceAssure

DeviceAssure

DeviceAssure enables organizations to reliably identify counterfeit and non-standard devices with a real-time check on a device's authenticity.

Innovent Recycling

Innovent Recycling

Innovent Recycling provides a secure IT recycling & data destruction service to all types of organizations across the UK.

SixThirty CYBER

SixThirty CYBER

SixThirty is a venture fund that invests in early-stage enterprise technology companies from around the world building FinTech, InsurTech, and Cybersecurity solutions.

jobsDB.com

jobsDB.com

jobsDB Singapore is a search engine for jobs throughout Singapore.

Dcode

Dcode

Dcode connects the tech industry and government to drive commercial innovation in the federal market.

SecureStrux

SecureStrux

SecureStrux are a cybersecurity consulting firm providing specialized services in the areas of compliance, vulnerability assessment, computer network defense, and cybersecurity strategies.

NOW Insurance

NOW Insurance

NOW Insurance provides small business owners and other professional classes with a seamless purchasing experience for general liability, professional liability, and cybersecurity insurance coverage.

NVISIONx

NVISIONx

NVISIONx data risk governance platform enables companies to gain control of their enterprise data to reduce data risks, compliance scopes and storage costs.

watchTowr

watchTowr

Continuous Attack Surface Testing, with the watchTowr Platform. The future of Attack Surface Management.

CyberTest

CyberTest

CyberTest offers cybersecurity consulting and penetration testing services that helps organizations and businesses securing their assets.

Nothreat

Nothreat

Nothreat has revolutionized how businesses like yours protect themselves from damaging cyber attacks. Our tech learns and adapts in real time, protecting clients from even zero-day attacks.