CISA, FBI Identify North Korean Hacking Operation

The Department of Defense (DoD), Federal Bureau of Investigation, and Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) detailed a North Korean hacking operation that employs seven pieces of malware.

The U.S. Cyber National Mission Force – a part of U.S. Cyber Command – said the malware is “currently used for phishing & remote access by [North Korean] cyber actors to conduct illegal activity, steal funds, & evade sanctions.”

CISA posted the malware examples on its website and referred to the malicious cyber activity as Hidden Cobra. Cool code name aside, CISA encouraged users and administrators to review its Malware Analysis Report for each of the malware pieces listed:

• Hoplight
• Bistromath
• Slickshoes
• Hotcroissant
• Artfulpie
• Buffetline
• Crowdedflounder