US blames North Korea for Fallchill trojan

Fallchill RAT was created by Hidden Cobra group, claim security agencies

The FBI and US Department of Homeland Security have issued a joint warning related to several IP addresses infected with the Fallchill remote access trojan (RAT) an alleged North Korean cyber weapon.

According to the alert, the Fallchill malware has been targeting the aerospace, telecommunications and finance industries since 2016. Once an infection has taken hold, the threat actors behind it can issue multiple commands from command and control (C2) servers while obfuscating their identities behind a number of proxies.

The agencies claim to have linked Fallchill to a group it calls Hidden Cobra, which is said to be a North Korean state-sponsored operation behind a number of other malware initiatives that has been active since 2009.

"Fallchill typically infects a system as a file dropped by other Hidden Cobra malware or as a file downloaded unknowingly by users when visiting sites compromised by Hidden Cobra actors," the advisory reads.

"Hidden Cobra actors use an external tool or dropper to install the Fallchill malware-as-a-service to establish persistence. Because of this, additional Hidden Cobra malware may be present on systems compromised with Fallchill."

In terms of operation, Fallchill allows the malicious actors to retrieve information about all installed disks; create, start and terminate new processes and their primary thread; read, search, write, move and execute files; access and modify file or directory timestamps; change the directory for a process or file and delete malware and related artifacts from the infected system.

This can lead to disruption of operations and temporary or permanent loss of files.

Further information on the hallmarks of Fallchill and Hidden Cobra activity, as well as how to resolve an infection, can be found here.

North Korea last month denied it was responsible for the WannaCry ransomware attack that attacked businesses and hospitals in the UK back in May, calling the UK government's allegation "wicked".

Main image credit: Bigstock

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Microsoft hints at stand-alone successor to Office 2019 suite
Microsoft Office

Microsoft hints at stand-alone successor to Office 2019 suite

24 Sep 2020