US-CERT warns of more North Korean malware
The United States Department of Homeland Security’s Computer Emergency Response Team (US-CERT) has warned against another malware campaign it says originates from North Korea.
In its advisory, US-CERT said the “Typeframe” malware “includes malware descriptions related to HIDDEN COBRA”, the tag applied to a North Korean hacking team which in June 2017 was pinged as attacking “media, aerospace, financial, and critical infrastructure”.
The advisory doesn’t say how many machines may have been infected by Typeframe, nor where infections occurred.
Hidden Cobra has been busy recently: at the end of May, it was the subject of another US-CERT technical alert regarding the Joanap and Brambul malware strains, and last week we reported that the hacking group’s tools were spotted in an attack on Banco de Chile.
The latest advisory includes 11 samples in the Typeframe campaign. Most are simple Windows 32-bit and 64-bit remote access trojans with RC4-encrypted configuration files, but some add more sophisticated backdoors. Most were compiled in 2016 and 2017, but one venerable example in the list was put together in 2015.
Command and control IP addresses in the campaign include 111.207.78.204, 181.119.19.56, 184.107.209.2, 59.90.93.97, 80.91.118.45, 81.0.213.173, and 98.101.211.162. The servers are scattered across the USA, Morocco, China, Dubai, Albania, Mexico and India. ®
Sponsored: Minds Mastering Machines – Call for papers now open
READ MORE HERE