Malware Update: Lazarus Group HOPLIGHT

On April 10, 2019, US-CERT released a malware report on a new spyware family by Lazarus Group/Hidden Cobra, an APT linked to North Korea. The report names the new malware, HOPLIGHT, as a piece of spyware that is designed to obfuscate traffic while it exfiltrates data from victims' computers. The malware is able to create fake TLS sessions and disguise network connections in order to trick defenders. Beneath all of the obfuscation programs is a function that can covertly exfiltrate files off the computer, as well as do some basic remote administration tool functions such as read or write to disk and access system functions.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, and implement a custom rule to monitor for any company-specific leaked technical information
• Keep your security systems up to date with the latest detections and indicators from US-CERT
• Maintain secure backups of all business critical information
• Create robust network segmentation to prevent pivoting between business units

Details

The US-CERT report did not give any information on how HOPLIGHT is attributed to Lazarus Group/Hidden Cobra. Lazarus Group is an anomaly in Nation-State hacking groups, as its primarily financially motivated as opposed to other groups that have traditional intelligence goals. For example, the group was notoriously attributed to the Sony Hack years ago. For an up to date catalog of Lazarus Group Activity, refer to US-CERT's page on it.

Indicators of compromise provided by US-CERT

File hashes

05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 

12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d 

2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 

4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 

4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 

70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 

83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a 

d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 

ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d 

49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359 (rdpproto.dll)

70902623c9cd0cccc8513850072b70732d02c266c7b7e96d2d5b2ed4f5edc289 (udbcgiut.dat)

96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 (MSDFMAPI.INI)

cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f (UDPTrcSvc.dll)

IPs

112.175.92.57

113.114.117.122

128.200.115.228

137.139.135.151

181.39.135.126

186.169.2.237

197.211.212.59

21.252.107.198

26.165.218.44

47.206.4.145

70.224.36.194

81.94.192.10

81.94.192.147

84.49.242.125

97.90.44.200