External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2025-07-07 05:41:18 -04:00
committed by GitHub
parent e27163967c
commit e68d9366cc
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
North Koreans APT/Famous Chollima/README.md
+3 -3
View File
@@ -1,6 +1,6 @@
# Famous Chollima APT Adversary Simulation # Famous Chollima APT Adversary Simulation
This is a simulation of attack by (Famous Chollima) APT group targeting job seekers to accomplish their goals and wide variety of United States (US) companies, the attack campaign was active early as December 2022, The attack chain starts with attackers invites the victim to participate in an online interview. The attackers likely uses video conferencing or other online collaboration tools for the interview. During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The threat actor likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor malware. I relied on paloalto unit42 to figure out the details to make this https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/ This is a simulation of attack by (Famous Chollima) APT group targeting job seekers to accomplish their goals and wide variety of United States (US) companies, the attack campaign was active early as December 2022, The attack chain starts with attackers invites the victim to participate in an online interview. The attackers likely uses video conferencing or other online collaboration tools for the interview. During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The actors likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor malware. I relied on paloalto unit42 to figure out the details to make this https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
![imageedit_4_8185813077](https://github.com/user-attachments/assets/cba7dd9b-d0e8-4b9c-b47a-7c413d8f91e5) ![imageedit_4_8185813077](https://github.com/user-attachments/assets/cba7dd9b-d0e8-4b9c-b47a-7c413d8f91e5)
@@ -103,8 +103,8 @@ packages?
The answer lies in the target itself mainly software engineers. These individuals already have all the The answer lies in the target itself mainly software engineers. These individuals already have all the
required packages installed, as Python is one of the most commonly used programming languages. required packages installed, as Python is one of the most commonly used programming languages.
Additionally, Python offers another advantage: scripts can be as short as just two lines, making Additionally, Python offers another advantage: scripts can be as short as just 60 lines, making
modifications to any script hosted on GitHub nearly undetectable. modifications to any script hosted on GitHub nearly undetectable with obfuscated JavaScript and deleted the comments after uploading the malicious code.
## The fifth stage (execution technique with obfuscated JavaScript-based payload hidden inside NPM) ## The fifth stage (execution technique with obfuscated JavaScript-based payload hidden inside NPM)