New North Korean Malware Can Reportedly Remove Itself From Compromised Systems

The US Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have claimed that North Korean state-sponsored hackers are using a remote access Trojan (RAT), dubbed BLINDINGCAN, to target American government contractors in the defense, aerospace and energy sectors. The apparent purpose of the attacks, which started earlier this year, is to gather intelligence about key military and energy technologies. The attacks had been detailed earlier by cyber-security firms, McAfee and ClearSky.

⚠️ Our latest Malware Analysis Report identifies a #malware variant used by North Korean actors to target government contractors. Organizations should immediately take action to defend their networks and reduce exposure: https://t.co/nT9rOXyuvF. #Cybersecurity #InfoSec

“This campaign utilized compromised infrastructure from multiple countries to host its command and control (C2) infrastructure and distribute implants to a victim’s system. CISA and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity”, said the report.