e5c0ca00ddcb691ad2d08f89e5e274661f6b3f0c.pdf (161 KB)

DHS and the FBI analyzed seven malicious Windows executables attributed to HIDDEN COBRA activity and identified them as BANKSHOT malware variants. Five samples function as proxy applications that mask operator traffic with a shared cipher, while two are RATs capable of running commands on infected systems. Two proxy variants can generate fake TLS handshake sessions using valid public SSL certificates, and one RAT uses OpenSSL-based encryption for C2 communications and may have installed proxy servers on compromised hosts. The report provides YARA detection logic and hashes for the analyzed files so defenders can hunt for proxy and RAT activity tied to North Korean government operations.