hidden cobra botnet

US-CERT details North Korean bot

As tensions between the U.S. and North Korea grow over international nuclear strike capabilities, the Department of Homeland Security and the FBI issued a joint alert on the technical details of the tools and infrastructure used by cyber actors in the North Korean government.

In June, DHS and the FBI warned that North Korea was using Hidden Cobra, a government-managed botnet infrastructure, to aim distributed denial-of-service attacks at critical infrastructure, media, aerospace, and financial sectors in the United States and around the globe.

Older, unpatched versions of Adobe's Flash media player and Microsoft's Silverlight video player were cited as potential attack vectors.

An Aug. 23 update posted on the U.S. Computer Emergency Readiness Team website provides more technical details on the operation and how to detect the North Korean bots on networks.

The two agencies identified the IP addresses of DeltaCharlie malware that North Korea used to manage its DDOS botnet infrastructure and updated detection and file information on the malware. The US-CERT notice includes indicators of compromise, malware descriptions, network signatures and host-based rules to help network defenders detect activity  that is allegedly driven by the North Korean government.

US-CERT said it had obtained three files associated with DeltaCharlie attack malware, which were designed to conduct three types of attacks to open the door for DDOS assaults.

The warning states that the files set up backdoor command-and-control capabilities on compromised systems, allowing malicious operators to take over controls and capabilities from the victim system so hackers can tailor their DDOS attack techniques.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at mrockwell@fcw.com or follow him on Twitter at @MRockwell4.


inside gcn

  • cyber hygiene (Lucky Business/Shutterstock.com)

    Cleaning up cyber hygiene

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group