External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2024-09-11 15:07:07 -04:00
committed by GitHub
parent 41cec30c65
commit f4086cf208
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Chinese APT/Mustang Panda/README.md
+6
View File
@@ -8,6 +8,8 @@ This attack included several stages including redirect to a Visual Studio Code w
1. Use Visual Studio Code's reverse shell to execute arbitrary code and deliver additional payloads. 1. Use Visual Studio Code's reverse shell to execute arbitrary code and deliver additional payloads.
2. used ToneShell to archive files for exfiltration, protecting the RAR archives with a unique password.
![imageedit_2_2412587919](https://github.com/user-attachments/assets/ccc11e78-40c9-4573-bb3f-1854e0058a0d) ![imageedit_2_2412587919](https://github.com/user-attachments/assets/ccc11e78-40c9-4573-bb3f-1854e0058a0d)
## The first stage (delivery technique) ## The first stage (delivery technique)
@@ -62,7 +64,11 @@ Now I have control over the target machine through my browser in Kali Linux.
_______________________________________________________________________________________________________________________ _______________________________________________________________________________________________________________________
## The second stage (implanting technique)
Upon logging in, the attacker is directed to a Visual Studio Code web environment linked to the compromised machine, where they are granted the ability to run commands, execute scripts, and create new files on the infected system.
Stately Taurus employed this method to deploy malware in compromised environments, carry out reconnaissance, and extract sensitive data. To ensure ongoing access to the reverse shell, the attacker set up persistence for a script called startcode.bat using a scheduled task that launches the shell.