HOPLIGHT Trojan

The HOPLIGHT Trojan is a backdoor Trojan that gives remote attackers control over your system. Its payload includes support for changing settings, injecting corrupted code into other programs' processes, enabling or deactivating services, and uploading or downloading files, among other features. Users should maintain stringent network security protocols and have anti-malware products ready for deleting a HOPLIGHT Trojan or preventing its installation attempts.

A Light Shining on Upcoming Network Security Probes

Recent reports from the US DHS and FBI are revealing details of anticipated attacks via a new tool in the kit of Northern Korean hackers. The APT group, Hidden Cobra (AKA Guardians of Peace, AKA Lazarus, etc.) is using a backdoor Trojan that includes a fully-fledged set of features for taking over any system that it infects. The HOPLIGHT Trojan also takes steps for hiding itself, although malware experts don't see signs of any extreme innovation, such as in the TajMahal's twin-layer C&C network.

The HOPLIGHT Trojan includes variants with proxy features for concealing its traffic from any traditional cyber-security or network-sniffing tools. They protect the identities of their transmissions by providing SSL certificates that make the activity look benign. The setup phase of the HOPLIGHT Trojan, also, includes some system statistics-harvesting features. However, the majority of its dangers are in the rest of its payload, which includes:

• The HOPLIGHT Trojan may download new files onto the system or upload ones to a C&C server.
• The HOPLIGHT Trojan may launch program processes at will or terminate ones that are in-memory, along with injecting new code into preexisting ones.
• The HOPLIGHT Trojan has complete control over Windows services and may start, stop or create them.
• The HOPLight Trojan can edit files by writing to them, read them, and move them into other locations.

Its features, also, include drive enumeration and remote host connections, as with most professionally-coded, backdoor Trojans.

Turn Down the Lights on Trojans

The HOPLIGHT Trojan is a security issue of high concern to likely targets of state espionage or sabotage. Such an attack could target the industrial sector, government networks, diplomatic offices, et al. Network admins classifying their hardware as possible targets should refer to the relevant US government advisory notice for a complete list of Indicators of Compromise and other, technical details. Security breaches are, in general, preventable through adherence to best practices such as avoiding suspicious e-mails and using robust passwords.

While it's implementation suggests the software equivalent of state warfare, the HOPLIGHT Trojan could become similarly deadly and invasive if threat actors deploy it against random Windows users. Since the backdoor Trojan gives significant control over to a remote threat actor, its presence could lead to an escalating series of infections and associated attacks. Users can disconnect from the Internet for blocking any unsafe communications and have their anti-malware solution of choice uninstall the HOPLIGHT Trojan.

The HOPLIGHT Trojan is a conservative deployment of a backdoor threat whose prime concerns are masking itself while letting hackers do what they want with the underlying PC. If there is a solution for network security, it involves proactive defenses that keep the HOPLIGHT Trojan's campaign from gaining a foothold.