U.S. flag

An official website of the United States government

Government Website

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Safely connect using HTTPS

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Breadcrumb

  1. Home
  2. About Us
  3. Site Links
  4. Archived
  5. News Archive
  6. DHS and FBI Release Joint Technical Alerts on Malicious North Korean Cyber Activity

Archived Content

In an effort to keep DHS.gov current, the archive contains outdated information that may not reflect current policy or programs.

DHS and FBI Release Joint Technical Alerts on Malicious North Korean Cyber Activity

Release Date: November 14, 2017

Today, DHS and FBI released a pair of Joint Technical Alerts (TA17-318A and TA17-318B) that provide details on tools and infrastructure used by North Korea to target the media, aerospace, financial, and critical infrastructure sectors in the United States and globally.

The North Korean government malicious cyber activity noted in these alerts is part of a long-term campaign of cyber-enabled operations that impact the U.S. Government and its citizens. Working closely with our interagency, industry and international partners, DHS is constantly working to arm network defenders with the tools they need to identify, detect and disrupt state and non-state actors targeting the networks and systems of our country and our allies.

Earlier this summer, DHS and FBI released a technical alert and malware analysis report (MAR) of a malware variant, known as DeltaCharlie, used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure.  The U.S. Government refers to all of this North Korean malicious cyber activity as HIDDEN COBRA and it is published on the National Cybersecurity and Communications Integration Center’s (NCCIC) U.S. Computer Emergency Readiness Team’s (US-CERT) website at www.us-cert.gov/hiddencobra.

On a daily basis, we share information about cyber threats, vulnerabilities, and other risks and the NCCIC is our primary hub for these important activities. Specifically, it occurs through the automated sharing of cyber threat indicators; the production of analytic reports and alerts containing threat and vulnerability mitigation information; and direct exchanges with analysts in the network defense community.

With our industry and government partners, we are looking to enhance our collaboration and partnerships across the globe to counter North Korea and another state or non-state actor’s malicious cyber activity, and we hope that, over time, public information sharing – such as the report today – will become a routine component of cooperation to address shared cyber threat.

Entities that find signs of this malicious cyber activity should report it to DHS’s National Cybersecurity and Communications Integration Center (NCCIC) or FBI through CyWatch or its local field offices.

Last Updated: 02/05/2021
Was this page helpful?
This page was not helpful because the content