North Korean Cyber Attacks Continue

The US Department of Homeland Security and FBI issued a new warning this week that North Korean government hackers are continuing to target critical US infrastructure for cyber attacks.

A technical report by DHS' National Cyber Awareness System reveals details of the tools and cyber methods being used by North Korean government hackers.

The alert said the North Korean government is using the cyber tools to "target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally."

The warning comes amid heightened tensions between the United States and North Korea. Pyongyang recently threatened to fire missiles at Guam prompting counter threats from the Trump administration. The notice lists Internet Protocol addresses linked to a malware called DeltaCharlie that is "used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure."

A botnet is a network of a large number of hijacked computers and networks that are used to conduct cyber-attacks designed to shut down networks by flooding them with digital requests.
"The US government refers to the malicious cyber activity by the North Korean government as Hidden Cobra," the notice said.
The technical details were published to assist computer administrators in identifying North Korea Botnet cyber strikes.
"FBI has high confidence that Hidden Cobra actors are using the IP addresses for further network exploitation," the notice said.

The government warning followed a report by the California-based security firm Palo Alto Networks earlier this month indicating that North Korean hackers were targeting US defense contractors.

The hackers sent out emails containing weaponised Microsoft Office documents, including one that used a fraudulent job offering for a position as a manager of the Terminal High Altitude Area Defense, or THAAD, the U.S. anti-missile system recently deployed to South Korea.
"The techniques and tactics the group uses have changed little in recent attacks," Palo Alto Networks stated in a report. "Tool and infrastructure overlaps with previous campaigns are apparent. Given that the threat actors have continued operations despite their discovery and public exposure it is likely they will continue to operate and launch targeted campaigns."
The North Korean Botnet has been operating since 2009 and have compromised "a range of victims" that were not specified by the notice. The latest DHS report provided additional details on the cyber threat from a report first published in June.
"Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the notice said, noting that security experts have identified two entities used as cover names by the North Koreans. They are the Lazarus Group and the Guardians of Peace.

The Guardians of Peace was the code name used by North Korean hackers who attacked Sony Pictures Entertainment in what officials have called one of the first publicly known state-sponsored cyber-attacks. The November 2014 cyber-attack against Sony was aimed at derailing release of the comedy film The Interview that involved a fictional plot to kill North Korean leader Kim Jong Un.

The attack resulted in the destruction of Sony networks and the theft and disclosure of valuable and sensitive internal data.
"DHS and FBI assess that Hidden Cobra actors will continue to use cyber operations to advance their government’s military and strategic objectives," the notice said.

Among the cyber-attack tools used by the North Koreans are botnets, keyloggers, remote access tools, and wiper malware.
Keyloggers are malware capable of remotely intercepting keyboard strokes in learning login and passwords; remote access tools are methods of creating covert openings in networks targeted for attacks; and wiper malware is used to destroy all data on targeted networks. The malware linked to the North Koreans includes variants called Destroyer, Wild Positron/Duuzer, and Hangman. The North Koreans also appear to be targeting networks that use older, unsupported Microsoft operating systems, such as Windows XP.
"The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation," the notice said. "These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users' environments."
The report warned that cyber-attacks can produce severe impacts, especially when sensitive information is stolen and made public.

DHS said that by using software security patches, technically blocking known malware, restricting administrator privileges, and using firewalls, up to 85 percent of cyber intrusions can be halted.
"However, many organisations fail to use these basic security measures, leaving their systems open to compromise," the report said.

Details of the North Korean hacker methods were disclosed by the security firm Novetta in a recent report, "Operation Blockbuster: Destructive Malware Report."
"The destructive malware within the Lazarus Group’s collection ranges from simplistic to moderately advanced in construction and style," the report said.
"The authors behind these destructive malware families have developed a set of tools capable of inflicting significant damage against a target either directly … or remotely. This further emphasises that even a moderately capable adversary with minimal resources is able to perform asymmetric cyberwar against a large target."

Free Beacon:

You Might Also Read: 

N. Korea Will Unleash Cyber Attacks On The US:

Ignoring Software Updates…:

WannaCry Also Hit Windows 7 Systems:

 


 

 

 

 

« Driverless Truck Fleet Gets UK Trial
Solutions To Combat ‘Fake News’ »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Help Net Security

Help Net Security

Help Net Security has been a prime resource for information security news and insight since 1998.

Open Networking Foundation (ONF)

Open Networking Foundation (ONF)

The Open Networking Foundation (ONF) is a non-profit operator led consortium driving transformation of network infrastructure and carrier business models.

National Response Centre for Cyber Crime (NR3C)

National Response Centre for Cyber Crime (NR3C)

National Response Centre for Cyber Crime (NR3C) is a law enforcement agency in Pakistan dedicated to fighting cyber crime.

Proofpoint

Proofpoint

Proofpoint provide the most effective cybersecurity and compliance solutions to protect people on every channel including email, the web, the cloud, social media and mobile messaging.

Identity Automation

Identity Automation

Identity Automation is a leading provider of Identity and Access Management software.

Brinqa

Brinqa

Brinqa is a leading provider of unified risk management and security analytics.to manage IT governance and technology risk.

Featurespace

Featurespace

Featurespace is a world-leader in Adaptive Behavioural Analytics and creator of the ARIC™ platform for fraud and risk management.

Department of Justice - Office of Cybercrime (DOJ-OOC)

Department of Justice - Office of Cybercrime (DOJ-OOC)

The Office of Cybercrime within the Philippines Department of Justice is the Central Authority in all matters relating to international mutual assistance and extradition for cybercrime.

In-Sec-M

In-Sec-M

In-Sec-M is a non-profit organization that brings together companies, learning and research institutions, and government actors to increase competitiveness of the Canadian cybersecurity industry.

Stellar Cyber

Stellar Cyber

Stellar Cyber makes Open XDR, the only comprehensive security platform providing maximum protection of applications and data wherever they reside.

SafeGuard Cyber

SafeGuard Cyber

The SafeGuard Cyber SaaS platform empowers enterprises to adopt the social and digital channels they need to reach customers, while reducing digital risk and staying secure and compliant.

Neosecure

Neosecure

NeoSecure is a specialist Cybersecurity Solutions and Managed Services provider in Latin America.

Island

Island

Island puts the enterprise in complete control of the browser, delivering a level of governance, visibility, and productivity that simply weren’t possible before.

Appalachia Technologies

Appalachia Technologies

Appalachia is a full service Managed Services Provider with a focus on cybersecurity, backed by the best engineers.

PROVINTELL Cyber Security

PROVINTELL Cyber Security

PROVINTELL is a Managed Security Service Provider (MSSP) specialising in Next-Gen Cyber Defense and Response to detect and respond to threats.

Technology Innovation Institute (TII)

Technology Innovation Institute (TII)

TII is a UAE-based research center that aims to lead global advances in AI, robotics, quantum computing, cryptography and secure communications and more.