US-CERT warns of new RAT threat from North Korea

The United States Computer Emergency Readiness Team (US-CERT) has issued a fresh warning that a new piece of malware believed to be created by North Korean government actors is on the lose on networks around the world.

Known as KEYMARBLE, the malware is a Remote Access Trojan (RAT), US-CERT said and cautioned users against opening attachments in emails, even when the sender appears to be known.

The RAT is a 32-bit Windows executable that can access device configuration data, download further files, run commands, modify the Windows Registry configuration and settings database, take screenshots and exfiltrate data, according to the Malware Analysis Report (MAR) by US-CERT.

US-CERT believes KEYMARBLE is disseminated by a North Korean hacking group called Hidden Cobra, which could be linked to other government-sponsored malware authors in the reclusive communist dictatorship, research by security vendors Intezer and McAfee show.

Intezer and McAfee say they have been able to link multiple North Korean hacking groups through significant code reuse in the malware utilised by them for attacks, after months of research and data gathering.

This includes the infamous WannaCry destructive malware, that used the same Windows Server Message Block (SMB) file sharing protocol module as the Mydoom, Joanap and DeltaAlfa malicious programs did.

The above malware has been attributed to North Korean hacking group Lazarus.

Intezer and McAfee said the Lazarus group has reused the SMB module from at least 2009 to 2017.

"From the Mydoom variant Brambul to the more recent Fallchill, WannaCry, and the targeting of cryptocurrency exchanges, we see a distinct timeline of attacks beginning from the moment North Korea entered the world stage as a significant threat actor," Intezer scientist Christiaan Beek and security researcher Jay Rosenberg wrote.

Apart from Lazarus, the security researchers believe Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy and 10 Days of Rain are North Korean and share code with one another.