North Korean CROWDEDFLOUNDER RAT deployed by HIDDEN COBRA
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analyzes CROWDEDFLOUNDER, a North Korean Remote Access Trojan deployed by HIDDEN COBRA for command execution and lateral movement.
The U.S. Government (DHS, FBI, DoD) has published a detailed malware analysis of CROWDEDFLOUNDER, a Themida-packed 32-bit Windows Remote Access Trojan attributed to North Korean government cyber operations under the HIDDEN COBRA campaign. The malware is designed to execute as a standalone application or install as a Windows service, and can operate in two modes: as a proxy listener for incoming commands or as a client connecting to remote command-and-control servers.
Once executed, CROWDEDFLOUNDER automatically modifies Windows Firewall settings to permit inbound and outbound traffic. It supports command-line arguments to specify listening ports (-p) or remote C2 hosts (-h), and uses a rotating XOR cipher to encrypt all C2 communications. The malware accepts a fully qualified domain name or IP address for C2; if DNS resolution fails, it derives an IP address by MD5-hashing the domain and XORing specific bytes from the hash.
The RAT provides operators with extensive capabilities including file transfer, secondary payload execution, shell command execution, process termination, file deletion and search, system information collection (disk space, storage device types), process enumeration, and DLL injection into remote processes. CISA recommends prioritizing detection and reporting of this malware, and applying standard malware prevention practices per NIST SP 800-83.
Mentioned in this report
Detection guidance
Netsh Firewall Disabled or Opmode Set to Disable
netsh used to turn off Windows Firewall profiles, a behaviour matching RAT self-configuration to permit inbound and outbound C2 traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Netsh Firewall Disabled or Opmode Set to Disable
id: 0e99a138-9c60-5582-ad07-a3020fa50779
status: experimental
description: Detects netsh.exe turning off Windows Firewall for all profiles, using
either advfirewall state off or the legacy firewall opmode disable. RATs such as
CROWDEDFLOUNDER modify firewall settings on execution so that inbound and outbound
C2 traffic is allowed. The rule keys on the command pattern, not on any specific
malware file name.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045c
tags:
- attack.defense-impairment
- attack.t1686
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \netsh.exe
selection_advfirewall:
CommandLine|contains|all:
- advfirewall
- set
- state
- 'off'
condition: selection_img and 1 of selection_a* and not filter_none
filter_none:
CommandLine|contains: __never_match_placeholder__
falsepositives:
- Administrators temporarily disabling the firewall during troubleshooting
- Lab or imaging scripts that reset firewall state
level: medium
author: Vorant
Netsh Firewall Allow Rule for Executable in User-Writable Path
netsh adding an allow firewall rule that references a program in a user-writable location, typical of malware opening itself up for C2 or proxy listening. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Netsh Firewall Allow Rule for Executable in User-Writable Path
id: 6c3083d8-6758-5fb9-b59e-6733060c99d1
status: experimental
description: Detects netsh.exe adding a Windows Firewall allow rule whose program
path is in a user-writable directory such as Temp, AppData, ProgramData or Users\Public.
Malware like CROWDEDFLOUNDER alters firewall policy to permit inbound and outbound
traffic for its listener or client mode.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045c
tags:
- attack.defense-impairment
- attack.t1686
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \netsh.exe
selection_rule:
CommandLine|contains|all:
- firewall
- add
- allow
selection_path:
CommandLine|contains:
- \AppData\
- \Temp\
- \ProgramData\
- \Users\Public\
condition: all of selection_*
falsepositives:
- Per-user applications such as Teams or Zoom installers adding firewall rules from
AppData
- Software deployment tools staging installers from ProgramData or Temp
level: medium
author: Vorant
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045c
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs