North Korea's HOPLIGHT trojan targets Windows systems globally

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

CISA documents HOPLIGHT, a North Korean trojan with remote access and credential theft capabilities, deployed via proxy malware and custom TLS obfuscation.

This CISA Malware Analysis Report documents HOPLIGHT, a trojan attributed to North Korea's HIDDEN COBRA cyber operations. The analysis covers twenty malicious executable files, sixteen functioning as SSL/TLS proxy applications that mask communications between malware and remote operators. HOPLIGHT itself is a 32-bit Windows trojan that collects system information, enumerates drives, executes processes, modifies registry settings, and communicates with command-and-control servers. The malware uses stolen SSL certificates (including one from Naver.com) and default PolarSSL keys for initial TLS handshakes, then switches to custom Linear Feedback Shift Register (LFSR) encryption for obfuscated post-handshake communications. A 64-bit variant hooks the Windows Local Security Authority (lsass.exe) and injects rdpproto.dll to load credential-theft APIs common in Pass-the-Hash toolkits. Infrastructure analysis reveals command servers in Zimbabwe, Ecuador, South Korea, and the United Kingdom, many using compromised or bulletproof-hosting providers. The malware drops configuration files containing hardcoded IP addresses and socket pairs, persists via registry modifications and service creation, and is capable of remote file exfiltration and arbitrary code execution.

title: LSASS Loading rdpproto.dll Module
id: bbbc2ca2-a0bc-51a4-9f13-c7dad49d0215
status: experimental
description: Detects lsass.exe loading a module named rdpproto.dll, consistent with
  the HOPLIGHT 64-bit variant that hooks LSASS and injects this DLL to expose Pass-the-Hash
  style credential APIs. Rule keys on the LSASS-as-host relation, not on a hash.
tags:
- attack.persistence
- attack.credential-access
- attack.t1547.008
- attack.t1550.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \lsass.exe
    ImageLoaded|endswith: \rdpproto.dll
  condition: selection
falsepositives:
- Unlikely; no known legitimate Windows component named rdpproto.dll loads into LSASS
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045g

title: Reg.exe Adding Run Key Pointing to User-Writable Path
id: 9d9d03eb-940a-5b52-acbe-e49a6c337c76
status: experimental
description: Detects reg.exe add against a Run or RunOnce key where the value data
  references a user-writable location such as AppData, Temp, ProgramData or Users\Public.
  Generalises on the persistence technique used by trojans like HOPLIGHT, not on specific
  value names.
tags:
- attack.persistence
- attack.t1547.001
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
    - ' add '
    - \CurrentVersion\Run
  selection_path:
    CommandLine|contains:
    - \AppData\
    - \Temp\
    - \ProgramData\
    - \Users\Public\
  filter_known:
    CommandLine|contains:
    - \Microsoft\OneDrive\
    - \AppData\Local\Programs\Microsoft VS Code\
  condition: selection_img and selection_path and not filter_known
falsepositives:
- Per-user software installers or login scripts that register autostart entries from
  AppData
- IT deployment scripts that set Run keys for tools installed under ProgramData
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045g

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045g