U.S. announces disruption of ‘Joanap’ botnet linked with North Korea

Joanap's disruption comes after U.S. charges against a North Korean linked with the Sony Pictures hack.

The Justice Department on Wednesday announced a wide-ranging operation to map and disrupt a botnet linked to North Korea that has infected numerous computers across the globe over the last decade.

Through a search warrant and court order, the department inflicted a potentially damaging blow to the so-called Joanap botnet, which U.S. officials attributed to the North Korean government. The search warrant allowed the FBI to control servers that mimicked computers within the botnet, giving the bureau a clearer picture of the zombie computer army and the ability to alert victims.

Joanap is malware that targets Microsoft Windows. It works in tandem with a worm dubbed Brambul that stalks computers, looking for a vulnerable way in, the Justice Department said in a press release.

“Once installed on an infected computer, Joanap would allow the North Korean hackers to remotely access infected computers,” giving them root-level access and the chance to load more malicious code, the department said.

The groundwork for the disruption of Joanap was laid in a parallel investigation of a North Korean computer programmer named Park Jin Hyok. U.S. prosecutors last September unsealed charges against Park for his alleged role in the digital dismemberment of Sony Pictures Entertainment, among other North Korea-linked hacks. That alleged conspiracy used a strain of the Brambul malware, U.S. officials said.

The FBI is notifying Joanap’s victims through their internet service providers, but also contacting individuals whose computers aren’t behind a firewall or router. But plenty more work remains.

“Computers around the world remain infected by a botnet associated with the North Korean regime,” Assistant Attorney General John Demers said in a statement. He described the Justice Department initiative as an ambitious effort to “eradicate the threat that North Korea state hackers pose to the confidentiality, integrity, and availability of data.”

A Department of Homeland Security assessment published last May said that, since at least 2009, North Korean hackers had likely used Joanap and Brambul to target victims in “the media, aerospace, financial, and critical infrastructure sectors.”

The United States has struggled to deter North Korean hackers, whose targeting has shown few constraints. In an October advisory obtained by CyberScoop, the FBI told U.S. companies that North Korean computer operatives would continue to target financial institutions despite U.S. attribution of such activity to Pyongyang.

The longevity of Joanap, which can be detected by antivirus products, is testament to the enduring vulnerability of unpatched systems.

“While the Joanap botnet was identified years ago and can be defeated with antivirus software, we identified numerous unprotected computers that hosted the malware underlying the botnet,” said U.S. Attorney Nicola Hanna.

The search warrant for Joanap was based on a controversial amendment to Rule 41 of the Federal Rules of Criminal Procedure that the Supreme Court approved in 2016. The amendment lets U.S. judges issue warrants for computers outside of their jurisdictions. Critics have warned that the amendment would significantly broaden the FBI’s authorities in cyberspace, while backers have said the amendment is a necessary tool for tracking down cybercriminals.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure