North Korean Cyber Attacks Continue

The US Department of Homeland Security and FBI issued a new warning this week that North Korean government hackers are continuing to target critical US infrastructure for cyber attacks.

A technical report by DHS' National Cyber Awareness System reveals details of the tools and cyber methods being used by North Korean government hackers.

The alert said the North Korean government is using the cyber tools to "target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally."

The warning comes amid heightened tensions between the United States and North Korea. Pyongyang recently threatened to fire missiles at Guam prompting counter threats from the Trump administration. The notice lists Internet Protocol addresses linked to a malware called DeltaCharlie that is "used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure."

A botnet is a network of a large number of hijacked computers and networks that are used to conduct cyber-attacks designed to shut down networks by flooding them with digital requests.
"The US government refers to the malicious cyber activity by the North Korean government as Hidden Cobra," the notice said.
The technical details were published to assist computer administrators in identifying North Korea Botnet cyber strikes.
"FBI has high confidence that Hidden Cobra actors are using the IP addresses for further network exploitation," the notice said.

The government warning followed a report by the California-based security firm Palo Alto Networks earlier this month indicating that North Korean hackers were targeting US defense contractors.

The hackers sent out emails containing weaponised Microsoft Office documents, including one that used a fraudulent job offering for a position as a manager of the Terminal High Altitude Area Defense, or THAAD, the U.S. anti-missile system recently deployed to South Korea.
"The techniques and tactics the group uses have changed little in recent attacks," Palo Alto Networks stated in a report. "Tool and infrastructure overlaps with previous campaigns are apparent. Given that the threat actors have continued operations despite their discovery and public exposure it is likely they will continue to operate and launch targeted campaigns."
The North Korean Botnet has been operating since 2009 and have compromised "a range of victims" that were not specified by the notice. The latest DHS report provided additional details on the cyber threat from a report first published in June.
"Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the notice said, noting that security experts have identified two entities used as cover names by the North Koreans. They are the Lazarus Group and the Guardians of Peace.

The Guardians of Peace was the code name used by North Korean hackers who attacked Sony Pictures Entertainment in what officials have called one of the first publicly known state-sponsored cyber-attacks. The November 2014 cyber-attack against Sony was aimed at derailing release of the comedy film The Interview that involved a fictional plot to kill North Korean leader Kim Jong Un.

The attack resulted in the destruction of Sony networks and the theft and disclosure of valuable and sensitive internal data.
"DHS and FBI assess that Hidden Cobra actors will continue to use cyber operations to advance their government’s military and strategic objectives," the notice said.

Among the cyber-attack tools used by the North Koreans are botnets, keyloggers, remote access tools, and wiper malware.
Keyloggers are malware capable of remotely intercepting keyboard strokes in learning login and passwords; remote access tools are methods of creating covert openings in networks targeted for attacks; and wiper malware is used to destroy all data on targeted networks. The malware linked to the North Koreans includes variants called Destroyer, Wild Positron/Duuzer, and Hangman. The North Koreans also appear to be targeting networks that use older, unsupported Microsoft operating systems, such as Windows XP.
"The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation," the notice said. "These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users' environments."
The report warned that cyber-attacks can produce severe impacts, especially when sensitive information is stolen and made public.

DHS said that by using software security patches, technically blocking known malware, restricting administrator privileges, and using firewalls, up to 85 percent of cyber intrusions can be halted.
"However, many organisations fail to use these basic security measures, leaving their systems open to compromise," the report said.

Details of the North Korean hacker methods were disclosed by the security firm Novetta in a recent report, "Operation Blockbuster: Destructive Malware Report."
"The destructive malware within the Lazarus Group’s collection ranges from simplistic to moderately advanced in construction and style," the report said.
"The authors behind these destructive malware families have developed a set of tools capable of inflicting significant damage against a target either directly … or remotely. This further emphasises that even a moderately capable adversary with minimal resources is able to perform asymmetric cyberwar against a large target."

Free Beacon:

You Might Also Read: 

N. Korea Will Unleash Cyber Attacks On The US:

Ignoring Software Updates…:

WannaCry Also Hit Windows 7 Systems:

 


 

 

 

 

« Driverless Truck Fleet Gets UK Trial
Solutions To Combat ‘Fake News’ »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Hack Miami

Hack Miami

HackMiami is the premier resource in South Florida for highly skilled hackers that specialize in vulnerability analysis, penetration testing, digital forensics, and all manner of IT security.

Markel International

Markel International

Markel International is an international insurance company which looks after the commercial insurance needs of businesses. Specialist services include Cyber Risk insurance.

Fidelis Security

Fidelis Security

Fidelis Security is a leading provider of extended threat detection and response (XDR) solutions for your security operations.

Atlantic Council Digital Forensic Research Lab (DFRLab)

Atlantic Council Digital Forensic Research Lab (DFRLab)

The Atlantic Council’s DFRLab has operationalized the study of disinformation by exposing falsehoods and fake news, documenting human rights abuses, and building digital resilience worldwide.

Shift Technology

Shift Technology

Shift Technology provides insurance companies with an innovative SaaS solution to improve and scale fraud detection.

Epati Information Technologies

Epati Information Technologies

ePati Information Technologies is a specialist in information technology and cyber security.

Rippleshot

Rippleshot

Rippleshot is a fraud analytics firm that detects mass card compromises faster, allowing issuers to execute more proactive fraud detection strategies.

CTM360

CTM360

CTM360 is a unified external security platform offering 24x7x365 Cyber Threat Management for detecting and responding to cyber threats.

Ericom Software

Ericom Software

Ericom is a global leader in securing and connecting the digital workspace, offering solutions that secure browsing, and optimize desktop and application delivery to any device, anywhere.

SGBox

SGBox

SGBox is a highly flexible and scalable solution for IT security. Choose the modules which your company needs and implement it without any modification to your network infrastructure.

CloudOak

CloudOak

CloudOak is a cloud channel provider for hybrid cloud Backup as a Service (BaaS), Disaster Recovery as a Service (DRaaS) and Archiving to Small to Medium Business (SMB).

Cybersecurity Manufacturing Innovation Institute (CyManII)

Cybersecurity Manufacturing Innovation Institute (CyManII)

CyManII was established to create economically viable, pervasive, and inconspicuous cybersecurity in American manufacturing to secure the digital supply chain and energy automation.

CYSIAM

CYSIAM

CYSIAM provides world-leading expertise in offensive security and critical incident response. We train our clients to be able to protect themselves and respond to attacks and breaches when they occur.

ORS Consulting

ORS Consulting

ORS Consulting is a specialist provider of risk management advisory services supporting asset-intensive industries such as chemicals, energy, power and utilities, defence and maritime.

Vigilant Ops

Vigilant Ops

Vigilant Ops is a leader in Software Bill of Materials (SBOM) Automation. A proactive approach to cybersecurity with continuous vulnerability monitoring.

Somos

Somos

From voice to messaging to fraud prevention and beyond, Somos are committed to developing innovative solutions that ensure that our ability to maintain trustworthy connections never stops.