External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-07-06 01:55:57 -04:00
committed by GitHub
parent fda431708a
commit 890923c0e2
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Famous Chollima/README.md
+14
View File
@@ -4,3 +4,17 @@ This is a simulation of attack by (Famous Chollima) APT group targeting job seek
![imageedit_4_8185813077](https://github.com/user-attachments/assets/cba7dd9b-d0e8-4b9c-b47a-7c413d8f91e5)
This attack included several stages including During the interview, the threat actor convinces the victim to download and install an NPM-based package hosted on GitHub. The attackers likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor.
1. Social Engineering Technique: The Attackers attempts to infect software developers with malware through a fictitious job interview.
2. GitHub Abuse for Contagious Interview: Attackers exploited GitHub, a trusted platform used daily by developers, to deliver or distribute malicious packages, leveraging its legitimacy and widespread adoption.
3. NPM-based package hosted on GitHub: Create JavaScript-based payload hidden inside Node Package Manager (NPM) packages. InvisibleFerret is a simple but Python-based backdoor. Both are cross-platform malware that can run on Windows, Linux and macOS.
4. TCP-C2 Server with XOR key: The C2 server returns JSON data instructing the backdoor with the next actions to take. The JSON response contains the same XOR key.