External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2024-09-19 15:23:57 -04:00
committed by GitHub
parent 1764f627a4
commit 0306dcf6d5
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Labyrinth Chollima/README.md
+3 -2
View File
@@ -1,7 +1,6 @@
# Labyrinth Chollima APT Adversary Simulation
This is a simulation of attack by (Labyrinth Chollima) APT group targeting victims working on energy company and the aerospace industry,
the attack campaign was active before June 2024, The attack chain starts with relies on legitimate job description content to target victims employed in U.S. critical infrastructure verticals. The job description is delivered to the victim in a password-protected ZIP archive containing an encrypted PDF file and a modified version of an open-source PDF viewer application, I relied on Mandiant to figure out the details to make this simulation: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-reader/?linkId=10998021
This is a simulation of attack by (Labyrinth Chollima) APT group targeting victims working on energy company and the aerospace industry, the attack campaign was active before June 2024, The attack chain starts with relies on legitimate job description content to target victims employed in U.S. critical infrastructure verticals. The job description is delivered to the victim in a password-protected ZIP archive containing an encrypted PDF file and a modified version of an open-source PDF viewer application, I relied on Mandiant to figure out the details to make this simulation: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-reader/?linkId=10998021
![imageedit_3_4780888868](https://github.com/user-attachments/assets/50214b93-9f5c-40ed-a31e-50aaacf448cc)
@@ -14,4 +13,6 @@ When accessed this way, the DLL files are loaded by the SumatraPDF.exe executabl
![imageedit_5_5991500850](https://github.com/user-attachments/assets/2c6f83ad-eab6-4445-98ec-5265d1b6dd34)
1.Create job description PDF file which will be sent spear phishing.