North Korean BUFFETLINE Trojan enables full remote access
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA identifies North Korean beaconing implant BUFFETLINE with file operations, process control, CLI access, and system enumeration capabilities.
The U.S. Government (DHS, FBI, DoD) has identified a full-featured Trojan malware variant designated BUFFETLINE attributed to the North Korean government as part of HIDDEN COBRA activity. The implant is a beaconing remote access tool that uses PolarSSL for initial session authentication followed by a custom FakeTLS scheme with modified RC4 encryption for command and control communications.
BUFFETLINE demonstrates sophisticated tradecraft including dynamic DLL importing, obfuscated API lookups, and hardcoded command and control infrastructure. The malware performs victim enumeration, exfiltrates system information, and provides defenders a complete capability set: file download/upload/deletion, arbitrary file execution, Windows CLI access, process creation and termination, and system reconnaissance. The implant exchanges hardcoded 32-byte strings with C2 servers and transmits victim identification and internal IP addressing during the handshake phase.
CISA provided indicators including a malware hash, two hardcoded C2 IP addresses on port 443, the embedded PolarSSL certificate and private key material, Python decryption scripts for obfuscated strings and network traffic, and a Snort detection rule targeting the FakeTLS handshake anomaly. Organizations should prioritize detection and blocking of the identified C2 infrastructure and flag any activity consistent with the malware's beacon signature.
Mentioned in this report
Detection guidance
Command Shell Chaining Multiple Host and Network Discovery Commands
cmd.exe or PowerShell running several reconnaissance utilities (systeminfo, tasklist, netstat, whoami, ipconfig) in a single command line, matching RAT-style victim enumeration through a remote CLI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Shell Chaining Multiple Host and Network Discovery Commands
description: Detects a single cmd.exe or PowerShell command line that chains several
discovery utilities (system info, process list, network connections, user context).
This matches the victim-enumeration and Windows CLI access capability of RATs such
as BUFFETLINE. Generalises on the chained-recon pattern, not on specific C2 values.
tags:
- attack.discovery
- attack.t1082
- attack.t1057
- attack.t1049
- attack.t1033
logsource:
category: process_creation
product: windows
detection:
selection_shell:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_combo_a:
CommandLine|contains|all:
- systeminfo
- tasklist
- netstat
selection_combo_b:
CommandLine|contains|all:
- systeminfo
- whoami
- ipconfig
selection_combo_c:
CommandLine|contains|all:
- tasklist
- netstat
- whoami
condition: selection_shell and 1 of selection_combo_*
falsepositives:
- Administrators running one-off troubleshooting or inventory one-liners
- IT support or diagnostic scripts that collect host information in a single command
level: medium
id: 3e5a1eed-ff17-5d34-ba4c-c7a2cccc4280
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045f
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045f
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs