North Korean TYPEFRAME RAT and proxy trojans
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analysis of North Korean TYPEFRAME malware: droppers, RATs, and proxy modules for persistence, C2 communication, and firewall manipulation.
This Malware Analysis Report (MAR) from CISA and FBI documents TYPEFRAME, a suite of trojans attributed to North Korean government cyber operations (HIDDEN COBRA). The analysis covers 11 malware samples including 32-bit and 64-bit Windows executables and a weaponized Word document with VBA macros. The toolkit is designed to establish persistent backdoor access, install remote access trojans (RATs), deploy proxy modules to convert compromised systems into relay nodes, and modify Windows Firewall rules to permit inbound connections. Droppers embed encrypted modules using RC4 encryption with consistent keys across variants. The malware communicates with C2 servers using crafted TLS sessions with public SSL certificates. RAT modules perform reconnaissance, file operations, process execution with elevated privileges, and service manipulation.
Mentioned in this report
Detection guidance
Netsh Firewall Rule Added to Allow Inbound Connections
netsh.exe adding an inbound-allow firewall rule or an allowed program, as TYPEFRAME does so its RAT and proxy modules can accept inbound connections. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Netsh Firewall Rule Added to Allow Inbound Connections
description: Detects netsh.exe creating an inbound allow rule or an allowed-program
entry in Windows Firewall. TYPEFRAME droppers and proxy modules modify firewall
rules to permit inbound connections to the implant. The rule matches the command
pattern, not a campaign-specific rule name or program path.
tags:
- attack.defense-impairment
- attack.t1112
- attack.t1090.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \netsh.exe
selection_adv:
CommandLine|contains|all:
- advfirewall
- add rule
- dir=in
- action=allow
selection_legacy:
CommandLine|contains|all:
- firewall
- add allowedprogram
condition: selection_img and (selection_adv or selection_legacy)
falsepositives:
- Software installers or game launchers that register inbound firewall exceptions
for their own binaries
- Administrators or GPO startup scripts opening ports for legitimate services
level: medium
id: 4bb13926-85e7-584f-91cb-866463fbc670
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-165a
Office Application Spawning Command Shell or Script Interpreter
Word, Excel or PowerPoint spawning cmd, script hosts or LOLBins, as a weaponized document with VBA macros does when dropping a TYPEFRAME loader. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Command Shell or Script Interpreter
description: Detects Microsoft Office processes spawning cmd.exe, PowerShell, script
hosts or common LOLBins. This is typical of a weaponized Word document with VBA
macros that drops and runs a backdoor dropper, as in the TYPEFRAME delivery chain.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.003
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection
falsepositives:
- Legitimate Office macros or add-ins that call cmd.exe for business automation
- Document management plugins launching helper scripts
level: high
id: d7b8b115-363a-5e9f-a5c0-4c212822e328
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-165a
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar18-165a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs