From 6236cba8a49587aed562c3a582bfe44a0b89686a Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Fri, 14 Feb 2025 18:00:27 -0500
Subject: [PATCH] Update README.md

---
 North Koreans APT/Velvet Chollima/README.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/North Koreans APT/Velvet Chollima/README.md b/North Koreans APT/Velvet Chollima/README.md
index f90e73d..74f756d 100644
--- a/North Koreans APT/Velvet Chollima/README.md	
+++ b/North Koreans APT/Velvet Chollima/README.md	
@@ -19,11 +19,11 @@ https://www.bleepingcomputer.com/news/security/fake-google-meet-conference-error
 
 
 
-1. social engineering: Create PDF file which will be sent spear-phishing.
+1. Social Engineering: Create PDF file which will be sent spear-phishing.
 
-2. ClickFix technique: (Fake-Captcha) to make the target run PowerShell as an administrator and paste attacker-provided code.
+2. ClickFix Technique: (Fake-Captcha) to make the target run PowerShell as an administrator and paste attacker-provided code.
 
-3. reverse shell: Make simple reverse shell (payload.ps1) to creates a TCP connection to a command and control (C2) server and listens for commands to execute on the target machine.
+3. Reverse Shell: Make simple reverse shell (payload.ps1) to creates a TCP connection to a command and control (C2) server and listens for commands to execute on the target machine.
 
 
 ## The first stage (delivery technique)
@@ -59,3 +59,5 @@ If the user follows the instructions and executes the code, it:
 Establishes a reverse shell connection to IP:PORT.
 Allows the attacker to remotely execute commands on the victim’s machine.
 Persists by adding itself to the Windows registry (Run Key), ensuring execution every time the system starts.
+
+## The third stage (Reverse shell by PowerShell)