News broke yesterday that the U.S. government issued an alert on the activities of a hacking group it called “Hidden Cobra,” saying the group was part of the North Korean government. The joint alert from the U.S. Department of Homeland Security and the Federal Bureau of Investigation said that “cyber actors of the North Korean government” had targeted the media, aerospace and financial sectors, as well as critical infrastructure, in the United States and globally. Tim Matthews, Vice President at Imperva commented below.
Tim Matthews, Vice President at Imperva:
The alleged connection to the attacks on South Korea and Sony reveal that these attacks are politically motivated. Botnets are readily available and relatively cheap to rent. That said, more research on the sophistication of the attacks will be required to truly assess the power and sophistication of Hidden Cobra. Just like weapons, botnets have degrees of sophistication that make them more of less threatening to nation states.
It’s not surprising to see that North Korea is using DDoS attacks which can cripple websites and are one of the most common uses for botnets as we’ve noted in the Imperva Incapsula 2016 Bot Traffic Report. In particular, the NTP and DNS DDoS attacks seen in Hidden Cobra (Delta Charlie) are among the most common types of DDoS attacks as noted in our Incapsula Q1 DDoS report.
Now that the U.S. Dept. of Homeland Security and FBI have identified the signature, we can monitor our Incapsula network for evidence of Hidden Cobra attacks and distinguish this botnet from all of the attack traffic we see.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.