Knowledge (XXG)

Joanap

Source 📝

1682: 69:(a US government term for malicious cyber activity conducted by North Korea) has most likely used Joanap, along with other malware like Brambul since at least 2009. According to the US government compromised IP addresses have been found in Argentina, Belgium, Brazil, Cambodia, China, Colombia, Egypt, India, Iran, Jordan, Pakistan, Saudi Arabia, Spain, Sri Lanka, Sweden, Taiwan, Tunisia. 1625: 470: 490: 156: 642: 182: 460: 404: 86: 1723: 87:"Justice Department Announces Court-Authorized Efforts to Map and Disrupt Botnet Used by North Korean Hackers | OPA | Department of Justice" 1666: 450: 219: 574: 988: 455: 1122: 1104: 605: 383: 149: 1128: 654: 615: 250: 429: 1188: 1134: 709: 600: 536: 373: 275: 1752: 595: 368: 1742: 1716: 475: 187: 177: 142: 1349: 739: 526: 465: 424: 322: 844: 579: 342: 1762: 1659: 1533: 874: 729: 521: 414: 358: 1014: 983: 610: 1709: 1152: 719: 637: 543: 516: 1308: 972: 445: 378: 224: 62:
communications, file management, process management, creation/deletion of directories, and node management.
1757: 1182: 1038: 869: 531: 1747: 1652: 1323: 1158: 942: 306: 1086: 967: 679: 388: 337: 332: 1585: 1457: 485: 301: 55: 1595: 1590: 1487: 1116: 879: 805: 495: 296: 23: 1600: 1482: 1452: 1056: 912: 270: 234: 51: 1693: 1636: 1528: 1380: 1303: 952: 889: 764: 213: 1538: 1513: 1477: 1405: 1318: 1313: 957: 749: 659: 363: 34:. It is two-stage malware, meaning it is "dropped" by another software (in this case the 1277: 1272: 962: 947: 937: 932: 864: 839: 834: 829: 774: 229: 1736: 1400: 859: 818: 814: 810: 66: 39: 1681: 1344: 1298: 1098: 1062: 917: 907: 800: 795: 790: 664: 480: 409: 59: 1689: 1580: 1570: 1518: 1426: 1370: 1282: 1231: 1092: 922: 649: 280: 114: 31: 42:
in 2018). Joanap establishes peer-to-peer communications and is used to manage
1523: 1508: 1436: 1226: 1176: 1080: 1032: 1008: 996: 854: 779: 769: 759: 744: 704: 629: 260: 115:"HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm" 1554: 1431: 1395: 1385: 1257: 1074: 824: 754: 694: 255: 1624: 1462: 1390: 1375: 1194: 1170: 1044: 1026: 927: 849: 684: 669: 569: 548: 327: 1632: 1492: 1365: 1328: 1262: 1241: 1211: 1164: 1146: 1068: 1002: 784: 699: 689: 674: 134: 47: 43: 35: 27: 1467: 1421: 1236: 1050: 1020: 899: 884: 714: 553: 265: 1200: 1140: 1110: 419: 1472: 1267: 511: 138: 451:
Hollywood Presbyterian Medical Center ransomware incident
1697: 1640: 1563: 1547: 1501: 1445: 1414: 1358: 1337: 1291: 1250: 1219: 1210: 981: 898: 728: 628: 588: 562: 504: 438: 397: 351: 315: 289: 243: 206: 199: 491:Russian interference in the 2016 U.S. elections 1717: 1660: 150: 50:devices that have been compromised it allows 8: 38:worm, which was part of the charges against 461:Democratic National Committee cyber attacks 1724: 1710: 1667: 1653: 1216: 405:Office of Personnel Management data breach 203: 157: 143: 135: 78: 109: 107: 46:that can enable other operations. On 7: 1678: 1676: 1621: 1619: 456:Commission on Elections data breach 16:Malware associated with North Korea 1696:. You can help Knowledge (XXG) by 1639:. You can help Knowledge (XXG) by 14: 616:Jeff Bezos phone hacking incident 1680: 1623: 1189:Microarchitectural Data Sampling 425:Ukrainian Power Grid Cyberattack 333:Cyberterrorism attack of June 25 537:2017 Ukraine ransomware attacks 374:2014 JPMorgan Chase data breach 369:2014 celebrity nude photo leak 1: 606:Bulgarian revenue agency hack 384:Russian hacker password theft 740:Bangladesh Black Hat Hackers 216:(publication of 2009 events) 54:, to drop and run secondary 601:Baltimore ransomware attack 65:The US government believes 1779: 1675: 1618: 875:Tailored Access Operations 522:WannaCry ransomware attack 415:Ashley Madison data breach 359:Anthem medical data breach 276:PlayStation network outage 30:used by the government of 611:WhatsApp snooping scandal 476:Indian Bank data breaches 170: 1153:Speculative Store Bypass 720:Ukrainian Cyber Alliance 517:2017 Macron e-mail leaks 527:Westminster data breach 446:Bangladesh Bank robbery 389:2014 Yahoo! data breach 379:2014 Sony Pictures hack 338:2013 Yahoo! data breach 323:South Korea cyberattack 225:Operation Olympic Games 220:Australian cyberattacks 1692:-related article is a 1635:-related article is a 870:Syrian Electronic Army 580:SingHealth data breach 343:Singapore cyberattacks 281:RSA SecurID compromise 1753:Types of cyberattacks 1159:Lazy FP state restore 943:Kristoffer von Hassel 596:Sri Lanka cyberattack 466:Vietnam Airport Hacks 307:Operation High Roller 1743:Crime in North Korea 1105:Silent Bob is Silent 165:Hacking in the 2010s 58:, initialization of 1039:SS7 vulnerabilities 575:Atlanta cyberattack 544:Equifax data breach 302:Stratfor email leak 251:Canadian government 230:Operation ShadowNet 1488:Petya and NotPetya 1117:ROCA vulnerability 880:The Shadow Brokers 806:Iranian Cyber Army 732:persistent threats 532:Petya and NotPetya 496:2016 Bitfinex hack 471:DCCC cyber attacks 430:SWIFT banking hack 26:that is a type of 24:remote access tool 1763:North Korea stubs 1705: 1704: 1648: 1647: 1613: 1612: 1609: 1608: 1601:ZeroAccess botnet 913:Mustafa Al-Bassam 680:New World Hackers 643:associated events 624: 623: 420:VTech data breach 271:Operation AntiSec 235:Operation Payback 194: 193: 93:. 30 January 2019 52:data exfiltration 1770: 1726: 1719: 1712: 1684: 1677: 1669: 1662: 1655: 1627: 1620: 1217: 890:Yemen Cyber Army 214:Operation Aurora 204: 173: 172: 159: 152: 145: 136: 129: 128: 126: 125: 111: 102: 101: 99: 98: 83: 1778: 1777: 1773: 1772: 1771: 1769: 1768: 1767: 1733: 1732: 1731: 1730: 1674: 1673: 1616: 1614: 1605: 1559: 1543: 1497: 1441: 1410: 1354: 1333: 1287: 1246: 1206: 986: 984:vulnerabilities 977: 894: 787:(confederation) 750:Charming Kitten 731: 724: 660:Goatse Security 620: 584: 558: 549:Deloitte breach 500: 486:Dyn cyberattack 434: 393: 364:Operation Tovar 347: 311: 285: 239: 200:Major incidents 195: 166: 163: 133: 132: 123: 121: 113: 112: 105: 96: 94: 85: 84: 80: 75: 17: 12: 11: 5: 1776: 1774: 1766: 1765: 1760: 1755: 1750: 1745: 1735: 1734: 1729: 1728: 1721: 1714: 1706: 1703: 1702: 1685: 1672: 1671: 1664: 1657: 1649: 1646: 1645: 1628: 1611: 1610: 1607: 1606: 1604: 1603: 1598: 1593: 1588: 1583: 1578: 1573: 1567: 1565: 1561: 1560: 1558: 1557: 1551: 1549: 1545: 1544: 1542: 1541: 1536: 1531: 1526: 1521: 1516: 1511: 1505: 1503: 1499: 1498: 1496: 1495: 1490: 1485: 1480: 1475: 1470: 1465: 1460: 1455: 1449: 1447: 1443: 1442: 1440: 1439: 1434: 1429: 1424: 1418: 1416: 1412: 1411: 1409: 1408: 1403: 1398: 1393: 1388: 1383: 1378: 1373: 1371:Black Energy 3 1368: 1362: 1360: 1356: 1355: 1353: 1352: 1347: 1341: 1339: 1335: 1334: 1332: 1331: 1326: 1321: 1316: 1311: 1306: 1301: 1295: 1293: 1289: 1288: 1286: 1285: 1280: 1278:Metulji botnet 1275: 1270: 1265: 1260: 1254: 1252: 1248: 1247: 1245: 1244: 1239: 1234: 1232:Black Energy 2 1229: 1223: 1221: 1214: 1208: 1207: 1205: 1204: 1198: 1192: 1186: 1180: 1174: 1168: 1162: 1156: 1150: 1144: 1138: 1132: 1126: 1120: 1114: 1108: 1102: 1096: 1090: 1087:Broadcom Wi-Fi 1084: 1078: 1072: 1066: 1060: 1054: 1048: 1042: 1036: 1030: 1024: 1018: 1012: 1006: 1000: 993: 991: 979: 978: 976: 975: 970: 965: 960: 955: 950: 948:Junaid Hussain 945: 940: 938:Jeremy Hammond 935: 933:Elliott Gunton 930: 925: 920: 915: 910: 904: 902: 896: 895: 893: 892: 887: 882: 877: 872: 867: 865:Stealth Falcon 862: 857: 852: 847: 842: 840:PLA Unit 61486 837: 835:PLA Unit 61398 832: 830:Numbered Panda 827: 822: 808: 803: 798: 793: 788: 782: 777: 775:Equation Group 772: 767: 762: 757: 752: 747: 742: 736: 734: 726: 725: 723: 722: 717: 712: 707: 702: 697: 692: 687: 682: 677: 672: 667: 662: 657: 652: 647: 646: 645: 634: 632: 626: 625: 622: 621: 619: 618: 613: 608: 603: 598: 592: 590: 586: 585: 583: 582: 577: 572: 566: 564: 560: 559: 557: 556: 551: 546: 541: 540: 539: 529: 524: 519: 514: 508: 506: 502: 501: 499: 498: 493: 488: 483: 478: 473: 468: 463: 458: 453: 448: 442: 440: 436: 435: 433: 432: 427: 422: 417: 412: 407: 401: 399: 395: 394: 392: 391: 386: 381: 376: 371: 366: 361: 355: 353: 349: 348: 346: 345: 340: 335: 330: 325: 319: 317: 313: 312: 310: 309: 304: 299: 293: 291: 287: 286: 284: 283: 278: 273: 268: 266:HBGary Federal 263: 258: 253: 247: 245: 241: 240: 238: 237: 232: 227: 222: 217: 210: 208: 201: 197: 196: 192: 191: 185: 180: 171: 168: 167: 164: 162: 161: 154: 147: 139: 131: 130: 103: 77: 76: 74: 71: 15: 13: 10: 9: 6: 4: 3: 2: 1775: 1764: 1761: 1759: 1758:Malware stubs 1756: 1754: 1751: 1749: 1746: 1744: 1741: 1740: 1738: 1727: 1722: 1720: 1715: 1713: 1708: 1707: 1701: 1699: 1695: 1691: 1686: 1683: 1679: 1670: 1665: 1663: 1658: 1656: 1651: 1650: 1644: 1642: 1638: 1634: 1629: 1626: 1622: 1617: 1602: 1599: 1597: 1594: 1592: 1589: 1587: 1584: 1582: 1579: 1577: 1574: 1572: 1569: 1568: 1566: 1562: 1556: 1553: 1552: 1550: 1546: 1540: 1537: 1535: 1532: 1530: 1527: 1525: 1522: 1520: 1517: 1515: 1512: 1510: 1507: 1506: 1504: 1500: 1494: 1491: 1489: 1486: 1484: 1481: 1479: 1476: 1474: 1471: 1469: 1466: 1464: 1461: 1459: 1456: 1454: 1451: 1450: 1448: 1444: 1438: 1435: 1433: 1430: 1428: 1425: 1423: 1420: 1419: 1417: 1413: 1407: 1404: 1402: 1401:Gameover ZeuS 1399: 1397: 1394: 1392: 1389: 1387: 1384: 1382: 1379: 1377: 1374: 1372: 1369: 1367: 1364: 1363: 1361: 1357: 1351: 1348: 1346: 1343: 1342: 1340: 1336: 1330: 1327: 1325: 1322: 1320: 1317: 1315: 1312: 1310: 1307: 1305: 1302: 1300: 1297: 1296: 1294: 1290: 1284: 1281: 1279: 1276: 1274: 1271: 1269: 1266: 1264: 1261: 1259: 1256: 1255: 1253: 1249: 1243: 1240: 1238: 1235: 1233: 1230: 1228: 1225: 1224: 1222: 1218: 1215: 1213: 1209: 1202: 1199: 1196: 1193: 1190: 1187: 1184: 1181: 1178: 1175: 1172: 1169: 1166: 1163: 1160: 1157: 1154: 1151: 1148: 1145: 1142: 1139: 1136: 1133: 1130: 1127: 1124: 1121: 1118: 1115: 1112: 1109: 1106: 1103: 1100: 1097: 1094: 1091: 1088: 1085: 1082: 1079: 1076: 1073: 1070: 1067: 1064: 1061: 1058: 1055: 1052: 1049: 1046: 1043: 1040: 1037: 1034: 1031: 1028: 1025: 1022: 1019: 1016: 1013: 1010: 1007: 1004: 1001: 998: 995: 994: 992: 990: 985: 980: 974: 971: 969: 966: 964: 961: 959: 956: 954: 951: 949: 946: 944: 941: 939: 936: 934: 931: 929: 926: 924: 921: 919: 916: 914: 911: 909: 906: 905: 903: 901: 897: 891: 888: 886: 883: 881: 878: 876: 873: 871: 868: 866: 863: 861: 860:Rocket Kitten 858: 856: 853: 851: 848: 846: 843: 841: 838: 836: 833: 831: 828: 826: 823: 820: 816: 812: 811:Lazarus Group 809: 807: 804: 802: 799: 797: 794: 792: 789: 786: 783: 781: 778: 776: 773: 771: 768: 766: 763: 761: 758: 756: 753: 751: 748: 746: 743: 741: 738: 737: 735: 733: 727: 721: 718: 716: 713: 711: 708: 706: 703: 701: 698: 696: 693: 691: 688: 686: 683: 681: 678: 676: 673: 671: 668: 666: 663: 661: 658: 656: 653: 651: 648: 644: 641: 640: 639: 636: 635: 633: 631: 627: 617: 614: 612: 609: 607: 604: 602: 599: 597: 594: 593: 591: 587: 581: 578: 576: 573: 571: 568: 567: 565: 561: 555: 554:Disqus breach 552: 550: 547: 545: 542: 538: 535: 534: 533: 530: 528: 525: 523: 520: 518: 515: 513: 510: 509: 507: 503: 497: 494: 492: 489: 487: 484: 482: 479: 477: 474: 472: 469: 467: 464: 462: 459: 457: 454: 452: 449: 447: 444: 443: 441: 437: 431: 428: 426: 423: 421: 418: 416: 413: 411: 408: 406: 403: 402: 400: 396: 390: 387: 385: 382: 380: 377: 375: 372: 370: 367: 365: 362: 360: 357: 356: 354: 350: 344: 341: 339: 336: 334: 331: 329: 328:Snapchat hack 326: 324: 321: 320: 318: 314: 308: 305: 303: 300: 298: 297:LinkedIn hack 295: 294: 292: 288: 282: 279: 277: 274: 272: 269: 267: 264: 262: 259: 257: 254: 252: 249: 248: 246: 242: 236: 233: 231: 228: 226: 223: 221: 218: 215: 212: 211: 209: 205: 202: 198: 190: → 189: 186: 184: 181: 179: 176:←  175: 174: 169: 160: 155: 153: 148: 146: 141: 140: 137: 120: 116: 110: 108: 104: 92: 88: 82: 79: 72: 70: 68: 63: 61: 57: 53: 49: 45: 41: 40:Park Jin Hyok 37: 33: 29: 25: 21: 1748:Cyberattacks 1698:expanding it 1687: 1641:expanding it 1630: 1615: 1575: 1345:CryptoLocker 1099:DoublePulsar 918:Cyber Anakin 908:Ryan Ackroyd 801:Helix Kitten 796:Hacking Team 791:Guccifer 2.0 665:Lizard Squad 481:Surkov leaks 410:Hacking Team 122:. Retrieved 118: 95:. Retrieved 90: 81: 67:HIDDEN COBRA 64: 19: 18: 1690:North Korea 1581:NetTraveler 1519:LogicLocker 1427:Hidden Tear 1324:Red October 1183:Dragonblood 1093:EternalBlue 1057:Stagefright 923:George Hotz 900:Individuals 650:CyberBerkut 91:justice.gov 32:North Korea 1737:Categories 1524:Rensenware 1509:BrickerBot 1437:TeslaCrypt 1227:Bad Rabbit 1177:Foreshadow 1081:Cloudbleed 1033:Row hammer 1015:Shellshock 1009:Heartbleed 997:Evercookie 973:The Jester 855:Red Apollo 815:BlueNorOff 785:GOSSIPGIRL 780:Fancy Bear 770:Elfin Team 765:DarkMatter 760:Dark Basin 745:Bureau 121 705:Teamp0ison 630:Hacktivism 261:DNSChanger 124:2019-02-03 97:2019-02-03 73:References 1555:VPNFilter 1432:Rombertik 1396:FinFisher 1386:DarkHotel 1350:DarkSeoul 1258:Coreflood 1123:BlueBorne 1075:Dirty COW 989:disclosed 987:publicly 825:NSO Group 755:Cozy Bear 695:PayPal 14 638:Anonymous 512:SHAttered 256:DigiNotar 1596:Titanium 1539:XafeCopy 1534:WannaCry 1463:KeRanger 1391:Duqu 2.0 1376:Carbanak 1195:BlueKeep 1171:SigSpoof 1129:Meltdown 1045:WinShock 1027:Rootpipe 928:Guccifer 850:Pranknet 845:PLATINUM 819:AndAriel 730:Advanced 685:NullCrew 670:LulzRaft 570:Trustico 183:Timeline 56:payloads 1633:malware 1493:X-Agent 1483:Pegasus 1366:Brambul 1329:Shamoon 1273:Kelihos 1263:Alureon 1242:Stuxnet 1212:Malware 1165:TLBleed 1147:Exactis 1135:Spectre 1069:Badlock 1003:iSeeYou 968:Topiary 700:RedHack 690:OurMine 675:LulzSec 119:US-CERT 48:Windows 44:botnets 36:Brambul 28:malware 1576:Joanap 1529:Triton 1468:Necurs 1458:Jigsaw 1453:Hitler 1422:Dridex 1381:Careto 1304:Dexter 1237:SpyEye 1203:(2019) 1197:(2019) 1191:(2019) 1185:(2019) 1179:(2018) 1173:(2018) 1167:(2018) 1161:(2018) 1155:(2018) 1149:(2018) 1143:(2018) 1137:(2018) 1131:(2018) 1125:(2017) 1119:(2017) 1113:(2017) 1107:(2017) 1101:(2017) 1095:(2017) 1089:(2017) 1083:(2017) 1077:(2016) 1071:(2016) 1065:(2016) 1059:(2015) 1053:(2015) 1051:JASBUG 1047:(2014) 1041:(2014) 1035:(2014) 1029:(2014) 1023:(2014) 1021:POODLE 1017:(2014) 1011:(2014) 1005:(2013) 999:(2010) 982:Major 963:Track2 885:xDedic 715:UGNazi 20:Joanap 1688:This 1631:This 1591:Tinba 1478:Mirai 1406:Regin 1319:Mahdi 1314:Flame 1299:Carna 1283:Stars 1201:Kr00k 1141:EFAIL 1111:KRACK 1063:DROWN 188:2020s 178:2000s 60:proxy 22:is a 1694:stub 1637:stub 1586:R2D2 1571:Grum 1564:2019 1548:2018 1514:Kirk 1502:2017 1473:MEMZ 1446:2016 1415:2015 1359:2014 1338:2013 1292:2012 1268:Duqu 1251:2011 1220:2010 958:Sabu 710:TDO 655:GNAA 589:2019 563:2018 505:2017 439:2016 398:2015 352:2014 316:2013 290:2012 244:2011 207:2010 1309:FBI 953:MLT 817:) ( 1739:: 117:. 106:^ 89:. 1725:e 1718:t 1711:v 1700:. 1668:e 1661:t 1654:v 1643:. 821:) 813:( 158:e 151:t 144:v 127:. 100:.

Index

remote access tool
malware
North Korea
Brambul
Park Jin Hyok
botnets
Windows
data exfiltration
payloads
proxy
HIDDEN COBRA
"Justice Department Announces Court-Authorized Efforts to Map and Disrupt Botnet Used by North Korean Hackers | OPA | Department of Justice"


"HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm"
v
t
e
2000s
Timeline
2020s
Operation Aurora
Australian cyberattacks
Operation Olympic Games
Operation ShadowNet
Operation Payback
Canadian government
DigiNotar
DNSChanger
HBGary Federal

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.