External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-10-10 18:23:15 -04:00
committed by GitHub
parent 0524776655
commit 975af518ca
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Ricochet Chollima/README.md
+2
View File
@@ -74,6 +74,8 @@ As a result, the shellcode is loaded into memory and the memory area becomes exe
<img width="1321" height="563" alt="Screenshot From 2025-10-09 12-06-39" src="https://github.com/user-attachments/assets/1be791ba-35dd-41b8-931d-755a8d36f8e8" />
I used shellcode to execute calc.exe for testing but later after compiling the base payload I will use the host-file program included in BearC2 to upload the payload and obtain a masked URL. As shown in the server header for Dropbox in the figure, opening that link causes the payload to download automatically without any interaction from the victim. I will then use the (start) command, insert the URL that carries the payload convert it to shellcode and place it in the shellcode slot instead of the calc.exe shellcode.
## The fifth stage (Data Exfiltration) over Dropbox API C2 Channe
The attackers used the Dropbox C2 (Command and Control) API as a means to establish a communication channel between their payload and the attacker's server. By using Dropbox as a C2 server, attackers can hide their malicious activities among the legitimate traffic to Dropbox, making it harder for security teams to detect the threat.