From 097eab31a80868e6bd8c9340151953ca4cf0299c Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Sun, 27 Jul 2025 15:55:45 -0400 Subject: [PATCH] Update README.md --- North Koreans APT/Stardust Chollima/README.md | 40 ++++++++++++++++++- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/North Koreans APT/Stardust Chollima/README.md b/North Koreans APT/Stardust Chollima/README.md index 7158543..276c430 100644 --- a/North Koreans APT/Stardust Chollima/README.md +++ b/North Koreans APT/Stardust Chollima/README.md @@ -1,5 +1,41 @@ -# Famous Chollima APT Adversary Simulation +# Stardust Chollima APT Adversary Simulation -This is a simulation of attack by (Famous Chollima) APT group targeting job seekers to accomplish their goals and wide variety of United States (US) companies, the attack campaign was active early as December 2022, The attack chain starts with attackers invites the victim to participate in an online interview. The attackers likely uses video conferencing or other online collaboration tools for the interview. During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The threat actor likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor malware. I relied on paloalto unit42 to figure out the details to make this https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/ +This is a simulation of attack by (Stardust Chollima) APT group targeting Chilean interbank network, The attack +campaign was active in December 2018, have used PowerRatankba, a PowerShell-based malware variant that +closely resembles the original Ratankba implant. The Redbanc corporate network was infected with a version of +the PowerRatankba that was not detected by anti-malware. The way attackers delivered the malware, according to +Flashpoint a trusted Redbanc IT professional clicked to apply to a job opening found on social media (linkedin). +I relied on Security Affairs to figure out the details to make this: https://securityaffairs.com/79929/breaking-news/chilean-research-redbank-lazarus.html + +imageedit_2_7042384654 + +The dropper used to deliver the malware is related to the PowerRatankba, a Microsoft Visual C#/ Basic .NET +compiled executable associated with Stardust Chollima APT. The dropper was used to download a PowerRatankba +PowerShell reconnaissance tool, the dropper displays a fake job application form while downloads and executes +PowerRatankba in the background by useing (Base64). + +The PowerRatankba sample used in the Chilean interbank attack, differently from other variants, communicates to +the C&C server on HTTPS, This latter code is registered as a service through the “sc create” command as, +the malware gain persistence by setting an autostart. + +BushidoToken Threat Intel: https://blog.bushidotoken.net/2021/08/the-lazarus-heist-where-are-they-now.html + +SWIFTphish + + +1. Social engineering technique: The attackers delivered the malware, according toFlashpoint a trusted Redbanc IT +professional clicked to apply to a job opening found on social media. + +2. Fake job application form: The dropper displays a fake job application form while downloads and executes +PowerRatankba in the background by useing (Base64). + +3. PowerRatankba.ps1: The main backdoor creates a connection between the targeted device and gives the attacker full +control via C2 server and latter code is registered as a service through the “sc create” command as,“ the malware gain +persistence by setting an autostart . + +4. C&C server on HTTPS: When a command is received, it is executed using the PowerShell command in Windows. +The output of the command is captured and sent back to the C2 server. + +## The first stage (social engineering technique)