External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2024-09-10 14:38:05 -04:00
committed by GitHub
parent a0438e8d2f
commit 4f0db9e15d
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Chinese APT/Mustang Panda/README.md
+7
View File
@@ -6,4 +6,11 @@ This is a simulation of attack by (Mustang Panda) APT group targeting government
This attack included several stages including redirect to a Visual Studio Code web environment that is connected to the compromised machine. They are then permitted to execute commands and scripts, and to create new files on the infected machine, Stately Taurus used this technique to deliver malware to infected environments, perform reconnaissance and exfiltrate sensitive data. To establish constant access to the reverse shell, the attacker created persistence for a script named (startcode.bat) using a scheduled task that is responsible for starting the shell.
1. Use Visual Studio Code's reverse shell to execute arbitrary code and deliver additional payloads.
![imageedit_2_2412587919](https://github.com/user-attachments/assets/ccc11e78-40c9-4573-bb3f-1854e0058a0d)
## The first stage (delivery technique)