---
title: Backdoor Trojan Being Delivered by Nation-State Backed Spearphishing
description: North Korean cyber attackers are serving up a backdoor trojan through spearphishing and other methods.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [Backdoor Trojan Being Delivered by Nation-State Backed Spearphishing](https://www.secureworld.io/industry-news/backdoor-trojan-being-delivered-by-nation-state-backed-spearphishing)

 Written by [SecureWorld News Team](https://www.secureworld.io/industry-news/author/secureworld-news-team) | Wed | Nov 15, 2017 | 6:22 PM Z

North Korea's army of hackers is at it again.

This time, they're using a spearphishing campaign to deliver a backdoor trojan known as Volgmer.

According to a new [joint Technical Alert](https://www.us-cert.gov/ncas/alerts/TA17-318B) (TA) issued by the FBI and the Department of Homeland Security, Volgmer has several capabilities:

- gathering system information,
- updating service registry keys,
- downloading and uploading files,
- executing commands,
- terminating processes,
- listing directories.

The technical advisory lists [indicators of compromise](https://www.us-cert.gov/ncas/alerts/TA17-318B) to look for and makes note of the fact that although North Korean cyber actors (dubbed HIDDEN COBRA) spread this primarily through spearphishing, it's possible other tools are also used to compromise networks.

The Department of Homeland Security and the FBI also issued an alert about FALLCHILL[ malware](https://www.secureworld.io/industry-news/north-korea-rat), which is another North Korean backed effort.

[View full post](https://www.secureworld.io/industry-news/backdoor-trojan-being-delivered-by-nation-state-backed-spearphishing)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "SecureWorld News Team"
  },
  "dateModified" : "2017-11-15T18:37:22.188Z",
  "datePublished" : "2017-11-15T18:22:00Z",
  "headline" : "Backdoor Trojan Being Delivered by Nation-State Backed Spearphishing",
  "image" : {
    "@type" : "ImageObject",
    "height" : 512,
    "url" : "https://cdn2.hubspot.net/hubfs/2221756/Blog_images/Doors-1690423.jpg",
    "width" : 960
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/backdoor-trojan-being-delivered-by-nation-state-backed-spearphishing",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```