Weekly Watch April 8-12, 2019

Looking Ahead

Oracle Patches

In the Spotlight This Week

On Wednesday, the Department of Homeland Security and Federal Bureau of Investigation released a Malware Analysis Report (MAR) about Hoplight, a new malware variant used in the North Korean government’s malicious cyber activities known has Hidden Cobra.  
 
As the report shows, this most recent malware campaign utilizes nine malicious executable files. Seven are proxy applications that have the ability to generate fake TLS handshake sessions using valid public SSL certificates, disguising network connections with remote malicious actors. One of the nine files contains a public SSL certificate with an encoded payload. The remaining file attempts outbound connections and drops four files that primarily contain IP addresses and SSL certificates. 
 
For more information: 
 
Official Malware Analysis Report (MAR-10135536-8): North Korean Trojan – Hoplight (contains IoCs)  
 
DHS and FBI Information on Hidden Cobra 
 
US CERT Warns of N. Korean 'Hoplight' Trojan 

REN-ISAC

Weekly Watch April 8-12, 2019

In Case You Missed It

Looking Ahead

In the Spotlight This Week

Research & Education Networks Information Sharing & Analysis Center