The Department of Homeland Security and FBI issued a new warning on Wednesday [Aug. 23] that North Korean government hackers are continuing to target critical U.S. infrastructure for cyber attacks.
A technical report by DHS’ National Cyber Awareness System reveals details of the tools and cyber methods being used by North Korean government hackers.
The alert said the North Korean government is using the cyber tools to “target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally.”
The warning comes amid heightened tensions between the United States and North Korea. Pyongyang recently threatened to fire missiles at Guam prompting counter threats from the Trump administration.
The notice lists Internet Protocol addresses linked to a malware called Delta- Charlie that is “used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure.”
A botnet is a network of a large number of hijacked computers and networks that are used to conduct cyber attacks designed to shut down networks by flooding them with digital requests.
“The U.S. government refers to the malicious cyber activity by the North Korean government as Hidden Cobra,” the notice said.
The technical details were published to assist computer administrators in identifying North Korea botnet cyber strikes.
“FBI has high confidence that Hidden Cobra actors are using the IP addresses for further network exploitation,” the notice said.
The government warning followed a report by the California-based security firm Palo Alto Networks earlier this month indicating that North Korean hackers were targeting U.S. defense contractors.
The hackers sent out emails containing weaponized Microsoft Office documents, including one that used a fraudulent job offering for a position as a manager of the Terminal High Altitude Area Defense, or THAAD, the U.S. anti-missile system recently deployed to South Korea.
“The techniques and tactics the group uses have changed little in recent attacks,” Palo Alto Networks stated in a report. “Tool and infrastructure overlaps with previous campaigns are apparent. Given that the threat actors have continued operations despite their discovery and public exposure it is likely they will continue to operate and launch targeted campaigns.”
The North Korean botnet has been operating since 2009 and have compromised “a range of victims” that were not specified by the notice. The latest DHS report provided additional details on the cyber threat from a report first published in June.
“Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature,” the notice said, noting that security experts have identified two entities used as cover names by the North Koreans. They are the Lazarus Group and the Guardians of Peace.
The Guardians of Peace was the code name used by North Korean hackers who attacked Sony Pictures Entertainment in what officials have called one of the first publicly known state-sponsored cyber attacks.
The November 2014 cyber attack against Sony was aimed at derailing release of the comedy film The Interview that involved a fictional plot to kill North Korean leader Kim Jong Un.
The attack resulted in the destruction of Sony networks and the theft and disclosure of valuable and sensitive internal data.
“DHS and FBI assess that Hidden Cobra actors will continue to use cyber operations to advance their government’s military and strategic objectives,” the notice said.
Among the cyber attack tools used by the North Koreans are botnets, keyloggers, remote access tools, and wiper malware.
Keyloggers are malware capable of remotely intercepting keyboard strokes in learning login and passwords; remote access tools are methods of creating covert openings in networks targeted for attacks; and wiper malware is used to destroy all data on targeted networks.
The malware linked to the North Koreans includes variants called Destroyer, Wild Positron/Duuzer, and Hangman.
The North Koreans also appear to be targeting networks that use older, unsupported Microsoft operating systems, such as Windows XP.
“The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation,” the notice said. “These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users’ environments.”
The report warned that cyber attacks can produce severe impacts, especially when sensitive information is stolen and made public.
DHS said that by using software security patches, technically blocking known malware, restricting administrator privileges, and using firewalls, up to 85 percent of cyber intrusions can be halted.
“However, many organizations fail to use these basic security measures, leaving their systems open to compromise,” the report said.
Details of the North Korean hacker methods were disclosed by the security firm Novetta in a recent report, “Operation Blockbuster: Destructive Malware Report.”
“The destructive malware within the Lazarus Group’s collection ranges from simplistic to moderately advanced in construction and style,” the report said.
“However, regardless of the structure and complexity of the code for any particular tool, their operational effectiveness is undeniable,” the report added.
“The author(s) behind these destructive malware families have developed a set of tools capable of inflicting significant damage against a target either directly or remotely. This further emphasizes that even a moderately capable adversary with minimal resources is able to perform asymmetric cyberwar against a large target.”
• This article by Bill Gertz, senior editor of the Washington Free Beacon, first appeared online on Aug. 24, 2017 and is reprinted with permission. Mr. Gertz also writes the weekly “Inside the Ring” column for The Washington Times.
Please read our comment policy before commenting.