Article Content Systems Affected  Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) This alert provides technical details on the tools and infrastructure used by cyber actors of the North Korean government to target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally Working with U.S Government partners, DHS and FBI identified Internet Protocol (IP) addresses associated with a malware variant, known as DeltaCharlie, used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure This alert contains indicators of compromise (IOCs), malware descriptions, network signatures, and host-based rules to help network defenders detect activity conducted by the North Korean government The U.S Government refers to the malicious cyber activity by the North Korean government as HIDDEN COBRA This alert identifies IP addresses linked to systems infected with DeltaCharlie malware and provides descriptions of the malware and associated malware signatures Government.For a downloadable copy of IOCs, see:IOCs (.csv)IOCs (.stix)On August 23, 2017, DHS published a Malware Analysis Report (MAR-10132963) that examines malware functionality to provide detailed code analysis and insight into specific tactics, techniques, and procedures (TTPs) observed in the malware.For a downloadable copy of the MAR, see:MAR (.pdf)MAR IOCs (.stix)  Description Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature Commercial reporting has referred to this activity as Lazarus Group[1] and Guardians of Peace.[2] DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government’s military and strategic objectives Variants of malware and tools used by HIDDEN COBRA actors include Destover,[3] Wild Positron/Duuzer,[4] and Hangman.[5] DHS has previously released Alert TA14-353A,[6] which contains additional details on the use of a server message block (SMB) worm tool employed by these actors Further research is needed to understand the full breadth of this group’s cyber capabilities In particular, DHS recommends that more research should be conducted on the North Korean cyber activity that has been reported by cybersecurity and threat research firms.HIDDEN COBRA actors commonly target systems running older, unsupported versions of Microsoft operating systems The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users’ environments.HIDDEN COBRA is known to use vulnerabilities affecting various applications The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report.[7] This malware has used the IP addresses identified in the accompanying .csv and .stix files as both source and destination IPs In some instances, the malware may have been present on victims’ networks for a significant period.Technical DetailsDeltaCharlie is a DDoS tool used by HIDDEN COBRA actors, and is referenced and detailed in Novetta’s Operation Blockbuster Destructive Malware report The information related to DeltaCharlie from the Operation Blockbuster Destructive Malware report should be viewed in conjunction with the IP addresses listed in the .csv and .stix files provided within this alert DeltaCharlie is a DDoS tool capable of launching Domain Name System (DNS) attacks, Network Time Protocol (NTP) attacks, and Carrier Grade NAT (CGN) attacks Further details on the malware can be found in Novetta’s report available at the following URL:https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdfDetection and ResponseHIDDEN COBRA IOCs related to DeltaCharlie are provided within the accompanying .csv and .stix files of this alert Upon reviewing the traffic from these IP addresses, system owners may find that some traffic corresponds to malicious activity and some to legitimate activity Although created using a comprehensive vetting process, the possibility of false positives always remains These signatures and rules should be used to supplement analysis and should not be used as a sole source of attributing this activity to HIDDEN COBRA actors.Network Signaturesalert tcp any any -> any any (msg:"DPRK_HIDDEN_COBRA_DDoS_HANDSHAKE_SUCCESS"; dsize:6; flow:established,to_server; content:"|18 17 e9 e9 e9 e9|"; fast_pattern:only; sid:1; rev:1;)________________________________________________________________alert tcp any any -> any any (msg:"DPRK_HIDDEN_COBRA_Botnet_C2_Host_Beacon"; flow:established,to_server; content:"|1b 17 e9 e9 e9 e9|"; depth:6; fast_pattern; sid:1; rev:1;)________________________________________________________________YARA Rules{meta:description = “RSA Key”strings:$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 7748 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 3973 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 683F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}condition:any of them}________________________________________________________________{meta:description = “DDoS Misspelled Strings”strings:$STR1 = "Wating" wide ascii$STR2 = "Reamin" wide ascii$STR3 = "laptos" wide asciicondition:(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them}________________________________________________________________{meta:description = “DDoS Random URL Builder”strings:$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00 8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8 ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4 48 C3 }condition:$randomUrlBuilder}________________________________________________________________  Impact A successful network intrusion can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed Possible impacts include:temporary or permanent loss of sensitive or proprietary information,disruption to regular operations,financial losses incurred to restore systems and files, andpotential harm to an organization’s reputation Solution Mitigation StrategiesNetwork administrators are encouraged to apply the following recommendations, which can prevent as many as 85 percent of targeted cyber intrusions The mitigation strategies provided may seem like common sense However, many organizations fail to use these basic security measures, leaving their systems open to compromise:Patch applications and operating systems – Most attackers target vulnerable applications and operating systems Ensuring that applications and operating systems are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker Use best practices when updating software and patches by only downloading updates from authenticated vendor sites.Use application whitelisting – Whitelisting is one of the best security strategies because it allows only specified programs to run while blocking all others, including malicious software.Restrict administrative privileges – Threat actors are increasingly focused on gaining control of legitimate credentials, especially credentials associated with highly privileged accounts Reduce privileges to only those needed for a user’s duties Separate administrators into privilege tiers with limited access to other tiers.Segment networks and segregate them into security zones – Segment networks into logical enclaves and restrict host-to-host communications paths This helps protect sensitive information and critical services, and limits damage from network perimeter breaches.Validate input – Input validation is a method of sanitizing untrusted input provided by users of a web application Implementing input validation can protect against the security flaws of web applications by significantly reducing the probability of successful exploitation Some anti-virus products can limit execution to only the highest reputation files, stopping a wide range of untrustworthy code from gaining control.Understand firewalls – Firewalls provide security to make your network less susceptible to attack They can be configured to block data and applications from certain locations (IP whitelisting), while allowing relevant and necessary data through.Response to Unauthorized Network AccessEnforce your security incident response and business continuity plan It may take time for your organization’s IT professionals to isolate and remove threats to your systems and restore normal operations Meanwhile, you should take steps to maintain your organization’s essential functions according to your business continuity plan Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.Contact DHS or your local FBI office immediately Specifically, carefully consider which ports should be connecting outbound versus inbound.Enforce a strict lockout policy for network users and closely monitor logs for failed login activity References  Revisions   June 13, 2017: Initial Release August 23, 2017: Updated YARA Rules and included MAR-10132963 (.pdf and .stix files)   This product is provided subject to this Notification and this Privacy & Use policy 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Systems Affected  Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) This alert provides technical details on the tools and infrastructure used by cyber actors of the North Korean government to target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally Working with U.S Government partners, DHS and FBI identified Internet Protocol (IP) addresses associated with a malware variant, known as DeltaCharlie, used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure This alert contains indicators of compromise (IOCs), malware descriptions, network signatures, and host-based rules to help network defenders detect activity conducted by the North Korean government The U.S Government refers to the malicious cyber activity by the North Korean government as HIDDEN COBRA This alert identifies IP addresses linked to systems infected with DeltaCharlie malware and provides descriptions of the malware and associated malware signatures Government.For a downloadable copy of IOCs, see:IOCs (.csv)IOCs (.stix)On August 23, 2017, DHS published a Malware Analysis Report (MAR-10132963) that examines malware functionality to provide detailed code analysis and insight into specific tactics, techniques, and procedures (TTPs) observed in the malware.For a downloadable copy of the MAR, see:MAR (.pdf)MAR IOCs (.stix)  Description Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature Commercial reporting has referred to this activity as Lazarus Group[1] and Guardians of Peace.[2] DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government’s military and strategic objectives Variants of malware and tools used by HIDDEN COBRA actors include Destover,[3] Wild Positron/Duuzer,[4] and Hangman.[5] DHS has previously released Alert TA14-353A,[6] which contains additional details on the use of a server message block (SMB) worm tool employed by these actors Further research is needed to understand the full breadth of this group’s cyber capabilities In particular, DHS recommends that more research should be conducted on the North Korean cyber activity that has been reported by cybersecurity and threat research firms.HIDDEN COBRA actors commonly target systems running older, unsupported versions of Microsoft operating systems The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users’ environments.HIDDEN COBRA is known to use vulnerabilities affecting various applications The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report.[7] This malware has used the IP addresses identified in the accompanying .csv and .stix files as both source and destination IPs In some instances, the malware may have been present on victims’ networks for a significant period.Technical DetailsDeltaCharlie is a DDoS tool used by HIDDEN COBRA actors, and is referenced and detailed in Novetta’s Operation Blockbuster Destructive Malware report The information related to DeltaCharlie from the Operation Blockbuster Destructive Malware report should be viewed in conjunction with the IP addresses listed in the .csv and .stix files provided within this alert DeltaCharlie is a DDoS tool capable of launching Domain Name System (DNS) attacks, Network Time Protocol (NTP) attacks, and Carrier Grade NAT (CGN) attacks Further details on the malware can be found in Novetta’s report available at the following URL:https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdfDetection and ResponseHIDDEN COBRA IOCs related to DeltaCharlie are provided within the accompanying .csv and .stix files of this alert Upon reviewing the traffic from these IP addresses, system owners may find that some traffic corresponds to malicious activity and some to legitimate activity Although created using a comprehensive vetting process, the possibility of false positives always remains These signatures and rules should be used to supplement analysis and should not be used as a sole source of attributing this activity to HIDDEN COBRA actors.Network Signaturesalert tcp any any -> any any (msg:"DPRK_HIDDEN_COBRA_DDoS_HANDSHAKE_SUCCESS"; dsize:6; flow:established,to_server; content:"|18 17 e9 e9 e9 e9|"; fast_pattern:only; sid:1; rev:1;)________________________________________________________________alert tcp any any -> any any (msg:"DPRK_HIDDEN_COBRA_Botnet_C2_Host_Beacon"; flow:established,to_server; content:"|1b 17 e9 e9 e9 e9|"; depth:6; fast_pattern; sid:1; rev:1;)________________________________________________________________YARA Rules{meta:description = “RSA Key”strings:$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 7748 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 3973 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 683F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}condition:any of them}________________________________________________________________{meta:description = “DDoS Misspelled Strings”strings:$STR1 = "Wating" wide ascii$STR2 = "Reamin" wide ascii$STR3 = "laptos" wide asciicondition:(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them}________________________________________________________________{meta:description = “DDoS Random URL Builder”strings:$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00 8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8 ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4 48 C3 }condition:$randomUrlBuilder}________________________________________________________________  Impact A successful network intrusion can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed Possible impacts include:temporary or permanent loss of sensitive or proprietary information,disruption to regular operations,financial losses incurred to restore systems and files, andpotential harm to an organization’s reputation Solution Mitigation StrategiesNetwork administrators are encouraged to apply the following recommendations, which can prevent as many as 85 percent of targeted cyber intrusions The mitigation strategies provided may seem like common sense However, many organizations fail to use these basic security measures, leaving their systems open to compromise:Patch applications and operating systems – Most attackers target vulnerable applications and operating systems Ensuring that applications and operating systems are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker Use best practices when updating software and patches by only downloading updates from authenticated vendor sites.Use application whitelisting – Whitelisting is one of the best security strategies because it allows only specified programs to run while blocking all others, including malicious software.Restrict administrative privileges – Threat actors are increasingly focused on gaining control of legitimate credentials, especially credentials associated with highly privileged accounts Reduce privileges to only those needed for a user’s duties Separate administrators into privilege tiers with limited access to other tiers.Segment networks and segregate them into security zones – Segment networks into logical enclaves and restrict host-to-host communications paths This helps protect sensitive information and critical services, and limits damage from network perimeter breaches.Validate input – Input validation is a method of sanitizing untrusted input provided by users of a web application Implementing input validation can protect against the security flaws of web applications by significantly reducing the probability of successful exploitation Some anti-virus products can limit execution to only the highest reputation files, stopping a wide range of untrustworthy code from gaining control.Understand firewalls – Firewalls provide security to make your network less susceptible to attack They can be configured to block data and applications from certain locations (IP whitelisting), while allowing relevant and necessary data through.Response to Unauthorized Network AccessEnforce your security incident response and business continuity plan It may take time for your organization’s IT professionals to isolate and remove threats to your systems and restore normal operations Meanwhile, you should take steps to maintain your organization’s essential functions according to your business continuity plan Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.Contact DHS or your local FBI office immediately Specifically, carefully consider which ports should be connecting outbound versus inbound.Enforce a strict lockout policy for network users and closely monitor logs for failed login activity References  Revisions   June 13, 2017: Initial Release August 23, 2017: Updated YARA Rules and included MAR-10132963 (.pdf and .stix files)   This product is provided subject to this Notification and this Privacy & Use policy  ### Response: .