From 5225ce26ad409d7a4e0d0689066422fa1b0aaa21 Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Fri, 14 Feb 2025 15:04:57 -0500 Subject: [PATCH] Update README.md --- North Koreans APT/Velvet Chollima/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/North Koreans APT/Velvet Chollima/README.md b/North Koreans APT/Velvet Chollima/README.md index 1feb967..3abb8fd 100644 --- a/North Koreans APT/Velvet Chollima/README.md +++ b/North Koreans APT/Velvet Chollima/README.md @@ -1,5 +1,5 @@ # Velvet Chollima APT Adversary Simulation -This is a simulation of an attack by the Velvet Chollima APT group targeting South Korean government officials. The attack campaign began in January 2025 and also targeted NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia. The attack chain starts with a spear-phishing email containing a PDF attachment. However, when targets attempt to read the document, they are redirected to a fake device registration link instructing them to run PowerShell as an administrator and execute attacker-provided code. This simulation is based on research from Microsoft's Threat Intelligence and Bleeping Computer: https://www.bleepingcomputer.com/news/security/dprk-hackers-dupe-targets-into-typing-powershell-commands-as-admin/ +This is a simulation of an attack by the (Velvet Chollima) APT group targeting South Korean government officials. The attack campaign began in January 2025 and also targeted NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia. The attack chain starts with a spear-phishing email containing a PDF attachment. However, when targets attempt to read the document, they are redirected to a fake device registration link instructing them to run PowerShell as an administrator and execute attacker-provided code. This simulation is based on research from Microsoft's Threat Intelligence and Bleeping Computer: https://www.bleepingcomputer.com/news/security/dprk-hackers-dupe-targets-into-typing-powershell-commands-as-admin/ ![imageedit_3_8386779397](https://github.com/user-attachments/assets/91dc82bd-27cf-4edc-a35a-a3b6cc87d909)