Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The November 15, 2017 report covered two distinct malware alerts linked by U.S. authorities to Hidden Cobra, the government label for malicious cyber activity attributed to North Korea: FALLCHILL, a remote access tool, and Volgmer, a backdoor Trojan. Their reported capabilities and infrastructure figures are historical, not current threat indicators.
What did the 2017 alerts cover?
CSO Online reported that the FBI and Department of Homeland Security issued alerts about FALLCHILL and Volgmer. The alerts followed a June 2017 DHS/FBI warning about DeltaCharlie. The report links to the original US-CERT alerts, but those technical pages are not available for verification here, so the details below are attributed to CSO Online’s 2017 account.
“Hidden Cobra” was the U.S. government’s label for malicious cyber activity attributed to the North Korean government. A later CISA archived page, last revised September 11, 2018, used the same label for a separate Trojan variant called KEYMARBLE; that does not establish anything about the current status of FALLCHILL or Volgmer.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How did FALLCHILL work, according to the report?
CSO described FALLCHILL as a fully functional remote access tool and a primary component of command-and-control infrastructure. It said the malware used multiple proxies to obscure traffic between an actor and victim systems. Its reported initial collection included operating-system version, processor, system name, MAC address, and local IP addresses.
#1 Best Overall
Reported capabilities
- Enumerating installed disks and searching, reading, writing, moving, and executing files.
- Modifying file timestamps and changing working directories.
- Creating and controlling processes.
- Deleting malware artifacts to conceal activity.
The 2017 account said the alert included signatures, YARA rules, mitigation guidance, and detection and response details, and listed 83 network nodes. It also said FALLCHILL had been used since 2016 against aerospace, telecommunications, and finance organizations. Possible infection routes included visiting a compromised site, an unintended download, or a secondary payload delivered by other malware. These are descriptions of activity reported at the time, not a present-day campaign assessment.
How did Volgmer differ?
CSO characterized Volgmer as a backdoor Trojan. Its account said it had been observed since 2013 in government, financial, media, and automotive sectors. Spear phishing was described as a common infection route, alongside the use of other custom compromise tools.
Reported capabilities and persistence
- Collecting system information and listing directories.
- Changing service registry keys, and uploading or downloading files.
- Executing commands and terminating processes.
- Installing itself as a service and modifying the registry to persist.
The article said payloads could be 32-bit executables or DLL files, and that communications commonly used TCP ports 8080 or 8088. One sample reportedly included botnet-controller functionality. The government analysis was reported to identify 94 static IP addresses. These technical details and counts are historical reporting, not current blocking guidance.
FALLCHILL and Volgmer compared
| Aspect | FALLCHILL | Volgmer |
|---|---|---|
| Role described in 2017 | Remote access tool and command-and-control component (CSO Online, 2017) | Backdoor Trojan (CSO Online, 2017) |
| Reported initial access | Compromised site, unintended download, or secondary malware payload (CSO Online, 2017) | Spear phishing was common; other custom compromise tools were also noted (CSO Online, 2017) |
| Reported sectors and timing | Aerospace, telecommunications, and finance; use reported since 2016 (CSO Online, 2017) | Government, finance, media, and automotive; observed since 2013 (CSO Online, 2017) |
| Historical infrastructure count | 83 network nodes listed in the alert, as reported by CSO Online (2017) | 94 static IP addresses identified in the analysis, as reported by CSO Online (2017) |
The figures are counts reported in 2017, not live inventories of malicious infrastructure. They should not be used as present-day indicators of compromise.
Rank #3
What should readers take from the alerts today?
The report is useful as a record of how the two malware families were described in 2017, but it cannot establish whether those tools remain active, how prevalent they are now, or whether the listed infrastructure is still malicious. The FBI’s cyber alert index reviewed October 8, 2026 lists later, separate advisories, including a September 18, 2026 alert about WaterPlum. That later alert is a reminder that threat advisories continue to change; it is not an update on FALLCHILL or Volgmer.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
