Skip to main content

North Korean Hackers Using ELECTRICFISH Tunnels to Exfiltrate Data

North Korean hacking tool

The U.S. Department of Homeland Security (DHS) and the FBI have issued another joint alert about a new piece of malware that the prolific North Korean APT hacking group Hidden Cobra has actively been using in the wild.

Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by North Korean government and known to launch cyber attacks against media organizations, aerospace, financial and critical infrastructure sectors across the world.

The hacking group was the same associated with the 2017 WannaCry ransomware menace, the 2014 Sony Pictures hack, and the SWIFT Banking attack in 2016.

Cobra hackers have been using for secretly tunneling traffic out of compromised computer systems.

The malware implements a custom protocol configured with a proxy server/port and proxy username and password, allowing hackers to bypass the compromised system's required authentication to reach outside of the network.

The ElectricFish malware is a command-line utility whose primary purpose is to quickly funnel traffic between two IP addresses.

The malware allows Hidden Cobra hackers to configure with a proxy server/port and proxy username and password, making it possible to connect to a system sitting inside of a proxy server, which allows the attackers to bypass the infected system's required authentication.

"It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be funneled between two machines," the alert reads.

"If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility."

Once ElectricFish authenticates with the configured proxy, it immediately attempts to establish a session with the destination IP address, located outside of the victim network and the source IP address. The attack would use command prompts to specify the source and destination for tunneling traffic.

Though the US-CERT website doesn't state whether or if yes, which US organizations have already been infected with this new malware, the joint malware analysis report (MAR) does say that the alert has been issued "to enable network defense and reduce exposure to North Korean government malicious cyber activity."

This is not the very first time the DHS and the FBI have issued a joint alert to warn users and organizations about the Hidden Cobra malware.

Late last year, the U.S. departments warned about the FastCash malware that Hidden Cobra had been using since 2016 to compromise payment switch application servers in banks in Africa and Asia in an attempt to cash out bank ATMs.

Little less than a year ago, the DHS and the FBI also published an advisory alerting users of two different malware—a fully functional Remote Access Trojan (RAT) known as Joanap and a Server Message Block (SMB) worm called Brambul—linked to Hidden Cobra.

In 2017, the US-CERT also issued an alert detailing Hidden Cobra malware called Delta Charlie—a DDoS tool that they believed the North Korean hackers use to launch distributed denial-of-service attacks against its targets.

Comments

Popular posts from this blog

Applications and Threats Content Release Notes

  Threat Intelligence Report Top Attacks and Breaches The biochemical systems at an Oxford university research lab currently studying the Covid-19 pandemic has been  breached . Clinical research was not affected by the incident. Breached systems include machines used to prepare biochemical samples, and hackers are currently attempting to  sell  their access to those machines. Twitter has permanently  suspended  multiple accounts found to be part of four disinformation campaign networks, most likely operated by state-sponsored actors associated with Iran, Russia and Armenia. The Iranian infrastructure was previously used to disrupt the 2020 US presidential campaign discourse. Gmail accounts of global pro-Tibet organizations have been  targeted  by the Chinese APT TA413, an espionage group known for its operations against civil dissidents. The campaign leverages a customized malicious Mozilla Firefox browser extension to gain control over the victims’ Gmail accounts. Npower, a British ga

Cisco Releases Security Updates for Cisco ASA 5506-X, 5508-X, 5516-X and Firepower// Cisco Bug IDs: CSCvp36425

A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reboot unexpectedly. The vulnerability is due to incomplete input validation of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) ingress packet header. An attacker could exploit this vulnerability by sending a crafted TLS/SSL packet to an interface on the targeted device. An exploit could allow the attacker to cause the device to reload, which will result in a denial of service (DoS) condition. Note:  Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid SSL or TLS session is required to exploit this vulnerability. Cisco has rel

Site-to-site IPsec VPN with two FortiGates

In this example, you will allow transparent communication between two networks that are located behind different FortiGates at different offices using route-based IPsec VPN. The VPN will be created on both FortiGates by using the VPN Wizard's   Site to Site - FortiGate   template. In this example, one office will be referred to as HQ and the other will be referred to as Branch. 1. Configuring the HQ IPsec VPN On the HQ FortiGate, go to  VPN > IPsec Wizard . Select the  Site to Site  template, and select  FortiGate . In the  Authentication  step, set  IP Address  to the IP of the Branch FortiGate (in the example,  172.20.120.135 ). After you enter the gateway, an available interface will be assigned as the  Outgoing Interface . If you wish to use a different interface, select it from the drop-down menu. Set a secure  Pre-shared Key . In the  Policy & Routing  step, set the  Local Interface . The  Local Subnets  will be added automatically. Set  Remote