{
  "family": "brambul",
  "sample_count": 2,
  "category": "worm",
  "description": "Worm:Win32/Brambul is an aggressive network-spreading worm developed by North Korean state-sponsored threat group HIDDEN COBRA (Lazarus Group / APT38). Discovered in 2009 and detailed in US-CERT Alert TA18-053A, Brambul is engineered to scan local subnets and random external internet IP addresses across TCP port 445, aggressively brute-forcing Server Message Block (SMB) credentials using hardcoded administrative password lists. Upon successful authentication, Brambul copies its payload to the target machine via administrative network shares (ADMIN$ or C$), registers Windows Run keys to achieve persistence, and uses embedded SMTP routines to exfiltrate detailed victim system configuration data back to threat actor email drop boxes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Brambul",
    "Worm:Win32/Brambul",
    "Hidden Cobra Brambul",
    "W32/Brambul",
    "Trojan.Brambul",
    "Lazarus SMB Worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Brambul worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brambul is an automated SMB worm developed by North Korean state-sponsored hackers (Lazarus Group) to propagate across enterprise networks via brute-force attacks."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor operates Brambul?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brambul is attributed to the North Korean state-sponsored cyber syndicate HIDDEN COBRA (Lazarus Group / APT38)."
      }
    },
    {
      "@type": "Question",
      "name": "How does Brambul spread across local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brambul scans TCP port 445 (SMB) and attempts to authenticate against Windows administrative shares using a built-in list of common passwords."
      }
    },
    {
      "@type": "Question",
      "name": "How does Brambul exfiltrate victim system data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brambul contains an embedded SMTP client that generates email messages reporting IP addresses, hostnames, and credentials to attacker-controlled inboxes."
      }
    },
    {
      "@type": "Question",
      "name": "What containment actions stop Brambul spreading?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block inbound and outbound TCP port 445 traffic at network boundaries, disable weak SMB passwords, and isolate infected endpoints."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1110.001",
    "T1570",
    "T1046",
    "T1547.001",
    "T1071.003",
    "T1082"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1110.001",
      "name": "Password Guessing",
      "tactic": "credential-access"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactic": "discovery"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1071.003",
      "name": "Mail Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "discovery"
    }
  ],
  "cisa_advisory": "TA18-053A",
  "last_updated": "2026-10-14",
  "first_seen": 2009,
  "lineage": {
    "derived_from": [],
    "variants": [
      "brambul smb worm v1",
      "brambul hidden cobra build",
      "brambul lazarus reconnaissance spreader"
    ]
  },
  "attribution": [
    {
      "actor": "HIDDEN COBRA (Lazarus Group / APT38)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2008-4250"
  ],
  "c2_profile": {
    "protocols": [
      "SMB",
      "SMTP"
    ],
    "ports": [
      445,
      25
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6e",
      "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f"
    ],
    "delivery": [
      "smb_port_445_brute_force",
      "lateral_network_transfer"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Windows System Directory Executable Drops"
    ]
  },
  "sources": [
    {
      "name": "US-CERT / CISA Alert TA18-053A: HIDDEN COBRA - Brambul SMB Worm",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/ta18-053a"
    },
    {
      "name": "MITRE ATT&CK Group G0032: Lazarus Group (HIDDEN COBRA)",
      "url": "https://attack.mitre.org/groups/G0032/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2008-4250",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4250"
    }
  ],
  "containment_steps": [
    "Immediately isolate endpoints exhibiting aggressive outbound TCP port 445 network scanning.",
    "Enforce strict firewall rules blocking inbound and outbound SMB (port 445) at enterprise perimeter gateways.",
    "Force a domain-wide password reset for any administrator accounts compromised during brute-force attempts.",
    "Deploy network monitoring to alert on repeated failed SMB authentication events (Event ID 4625)."
  ],
  "what_to_avoid": [
    "Do not allow direct SMB port 445 exposure to the public internet under any circumstances.",
    "Avoid using default, blank, or easily guessable passwords on local administrator accounts.",
    "Never ignore high volumes of internal SMB authentication failures occurring across subnets."
  ],
  "target_industries": [
    "government",
    "defense",
    "financial_services",
    "critical_infrastructure",
    "telecommunications"
  ],
  "motivation": "State-Sponsored Reconnaissance, Lateral Propagation & Initial Foothold Establishment",
  "threat_actors": [
    "HIDDEN COBRA",
    "Lazarus Group",
    "APT38"
  ],
  "target_geographies": [
    "US",
    "KR",
    "JP",
    "GB",
    "DE",
    "AU",
    "IN"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "credential-access",
    "lateral-movement",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}