Skip to main content

Hidden Cobra Trojans: COPPERHEDGE, PEBBLEDASH, and TAINTEDSCRIBE

Three new trojans believed to have been created the Hidden Cobra advanced persistent threat group have been observed.

Threat ID:
CC-3454
Category:
Trojan
Threat Severity:
Medium
Threat Vector:
Published:
14 May 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Three new trojans believed to have been created the Hidden Cobra advanced persistent threat group have been observed.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

  • Microsoft Windows - All versions

Threat details

At the time of publication, it is unclear how any of these trojans are delivered, although Hidden Cobra historically have been known to use sophisticated phishing campaigns and watering hole attacks to distribute their tools.

The following tools have been identified:

  • COPPERHEDGE - Associated with the Manuscrypt malware family, COPPERHEDGE is a full remote access trojan sometimes referred to as Autophyte. As with other Manuscript variants, COPPERHEDGE is targeted primarily at cryptocurrency exchanges and related entities.
  • PEBBLEDASH - Used as a beaconing implant and backdoor by other Hidden Cobra tools. PEBBLEDASH uses FakeTLS to secure its command and control communications; and is able to download or execute file, enable command-line access, or terminate processes.
  • TAINTEDSCRIBE - Similar functionality to PEBBLEDASH but uses a different encryption protocol for communications. TAINTEDSCIRBE's main executable will also disguise itself as Microsoft's Narrator application.

For further information:

Remediation steps

Type Step

To prevent and detect a trojan infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Last edited: 29 June 2021 12:01 pm