“On May 12, 2020, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) released three Malware Analysis Reports (MARs) on malware variants used by the North Korean government.” reads the DHS CISA’s advisory.
The information contained in the alerts and MARs listed above is the result of analytic efforts between the U.S. Department of Homeland Security, the U.S. Department of Defense, and the Federal Bureau of Investigation to provide technical details on the tools and infrastructure used by cyber actors of the North Korean government.”
In February, the government experts released new and updated Malware Analysis Reports (MARs) related to new malware families involved in new attacks carried out by North Korea-linked HIDDEN COBRA group.
Now, USCYBERCOM shares five more samples, the older one dated 2017 while the rest has been created in 2018.
The samples belong to the COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH malware families.
COPPERHEDGE is a remote access trojan (RAT) that allows attackers to run arbitrary commands, perform system reconnaissance, and exfiltrate data. COPPERHEDGE, aka Manuscrypt, has been employed in attacks on cryptocurrency exchanges. USCYBERCOM experts discovered six distinct variants of the malware.
TAINTEDSCRIBE is an implant that’s could execute the attacker’s commands on a compromised system.
PEBBLEDASH is an implant that has the capability to download, upload, delete, and execute files; the malicious code enables Windows CLI access, creates and terminates processes, and performs target system enumeration. The implant uses FakeTLS for session authentication and RC4 for network encoding.
The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS CISA) published security advisories for the three malware on its website.
(SecurityAffairs – North Korea, hacking)