CSIS Significant Cyber Incidents
CSIS entry 918 · June 2017
US-CERT identified the North Korean government as being behind a DDoS botnet infrastructure used to target media, financial, aerospace, and critical infrastructure organizations worldwide
CSIS entry 918
- Date (as written)
- June 2017
- Year
- 2017
- Actor pages
- HIDDEN COBRA
Source entries (6)
CISA/FBI joint advisories on DPRK
HIDDEN COBRA DDoS botnet (DeltaCharlie) targeting media, aerospace, financial, critical infrastructure · June 13, 2017 (last revised August 23, 2017)
This alert provides technical details on the tools and infrastructure used by cyber actors of the North Korean government to target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally.
Check Point Research
2017-6-19 Global Cyber Attack Reports · 2017-06-19
A technical alert has been published by the US Department of Homeland Security and the FBI. The report reveals new evidence of malicious activity originating from a malware called DeltaCharlie that is being used by the North Korean “Hidden Cobra” group to create its private DDoS botnet.
Hackmageddon cyber attacks timelines (Paolo Passeri)
>1 · 14/06/2017
The US-CERT identifies the North Korean government as being behind Hidden Cobra, a threat actor using DeltaCharlie, a DDoS botnet infrastructure that has been used to target media, financial, aerospace, and critical infrastructure organizations in the US and elsewhere.
ESTsecurity 알약 블로그 (blog.alyac.co.kr)
미국이 북한 Hidden Cobra 조직이 개발한 악성코드 DeltaCharlie에 주의 경고! · 2017-06-20
summary: DHS and FBI issue alert about North Korean 'Hidden Cobra' hackers 13일, 미국의 국토안보부(DHS)와 미국연방조사국(FBI) 연합은 DeltaCharlie 악성코드 패밀리에 대한 보고서를 발표하였습니다. 보고서에서는 이 악성코드 패밀리의 소유자(소위 Hidden Cobra조직)가 북한정부의 보호를 받고있다고 밝혔습니다. 지난 8년동안, 북한은 이 악성코드 패밀리를 이용하여 여러번의 DDoS 공격을 거행하였습니다. Hidden Cobra 조직은 2009년부터 활동을 하기 시작하였으며, 심지어 그보다 더 이른 2007년부터 사이버 스파잉 및 테러 활동에 참가한 것으로 추정되고 있습니다. 이번에 발표한 주의공지에서는 해당 조직과 관련된 정보와 DeltaCh.. | attribution sentence: Hidden Cobra란? 이번에 DHS와 FBI가 함께 발간한 보고서 및 Operation Blockbuster 의 보고서에 따르면, Hidden Cobra는 2014~2015년에 활동한 Lazarus(혹은 Guardians of Peace) 조직이며, DeltaCharlie는 이 해커조직이 개발한 또 다른 DDoS bot인 것으로 추정됩니다. | target sentence: 지난 8년동안, 해당 조직은 주로 매체, 항공, 금융 및 주요 기반시설을 타겟으로 공격을 진행하였습니다.
NETSCOUT ASERT blog
Pivoting off Hidden Cobra Indicators (US-CERT TA17-164A, North Korea’s DDoS botnet infrastructure, DeltaCharlie) · 2017-06-18T18:05:56-0400
On June 13th 2017, US-CERT issued a joint Technical Alert (TA17-164A) entitled Hidden Cobra – North Korea’s DDoS Botnet Infrastructure . The alert, which was the result of analytic efforts between the Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), included a list of IP addresses “linked to systems infected with DeltaCharlie”.
Values found later for empty fields
country: the United States and globally
cyber actors of the North Korean government to target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally.
actors: HIDDEN COBRA
Alert HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure