External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-08-07 13:58:05 -04:00
committed by GitHub
parent 973efae5b6
commit 7d8747803a
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Stardust Chollima/README.md
+4
View File
@@ -110,6 +110,10 @@ Once connected:
Persistence (Runs at Startup): The script modifies the Windows Registry (Run key) to automatically start on reboot. Persistence (Runs at Startup): The script modifies the Windows Registry (Run key) to automatically start on reboot.
Every time the user logs in, the malicious script executes again, ensuring the attacker regains control. Every time the user logs in, the malicious script executes again, ensuring the attacker regains control.
## The fourth stage (payload connect to HTTPS-C2 Server)
C&C server on HTTPS: When a command is received, it is executed using the PowerShell command in Windows.
The output of the command is captured and sent back to the C2 server.