From 6ec6021319cd2bc717c9f9e9a269cfbcfa6de9f7 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Mon, 7 Jul 2025 06:02:53 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Famous Chollima/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/North Koreans APT/Famous Chollima/README.md b/North Koreans APT/Famous Chollima/README.md
index 7e23da6..2024ee7 100644
--- a/North Koreans APT/Famous Chollima/README.md	
+++ b/North Koreans APT/Famous Chollima/README.md	
@@ -36,7 +36,9 @@ The attackers lure their victims by inviting them to job interviews. In other ca
 
 ![20250706_092112-Picsart-AiImageEnhancer](https://github.com/user-attachments/assets/d6088760-f8ba-4b34-99f9-634b35cbc98c)
 
+The logic behind this type of attack lies in the idea that instead of launching a direct attack on a company, an attacker can target an individual such as someone who was recently laid off and is actively seeking job opportunities. This person might still have access credentials to their former company’s email or possess sensitive company information. By compromising them, the attacker can gain indirect access to the organization.
 
+Additionally, even without these specific circumstances, the second part of the logic is that many individuals in the IT and software development community commonly look for freelance work alongside their main job. This is a perfectly normal behavior, making it a natural and less suspicious entry point for attackers to exploit.
 
 ![word-image-131292-13](https://github.com/user-attachments/assets/62200e9d-d953-4e9a-83d2-e5d244c4f4df)