From f5996039c1eeeee976fd2665a0ffc1576bafa573 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Mon, 27 Jul 2026 04:10:13 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Velvet Chollima/README.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/North Koreans APT/Velvet Chollima/README.md b/North Koreans APT/Velvet Chollima/README.md
index f4dcf46..bc90833 100644
--- a/North Koreans APT/Velvet Chollima/README.md	
+++ b/North Koreans APT/Velvet Chollima/README.md	
@@ -75,3 +75,18 @@ This access enables the attacker to control the system, extract sensitive data,
 
 ![Screenshot From 2025-02-14 18-22-11](https://github.com/user-attachments/assets/e5a74fee-7384-4f6c-9108-5b85f8227575)
 
+## MITRE ATT&CK Techniques
+
+| Technique ID | Technique | Implementation |
+|---------------|-----------|----------------|
+| **T1566.001** | Phishing: Spearphishing Attachment | Delivers a weaponized Microsoft Office document targeting South Korean government officials. |
+| **T1204.002** | User Execution: Malicious File | Requires the victim to open the malicious document and enable macro execution. |
+| **T1059.005** | Command and Scripting Interpreter: Visual Basic | Executes an obfuscated VBA macro to initiate the infection chain. |
+| **T1059.001** | Command and Scripting Interpreter: PowerShell | Uses PowerShell to download and execute the next-stage payload. |
+| **T1027** | Obfuscated Files or Information | Uses VBA obfuscation, encoded strings, and hidden macro logic to evade static analysis. |
+| **T1105** | Ingress Tool Transfer | Downloads the payload from the attacker-controlled infrastructure. |
+| **T1547.001** | Registry Run Keys / Startup Folder | Establishes persistence using Windows Registry Run keys. |
+| **T1071.001** | Application Layer Protocol: Web Protocols | Communicates with the C2 server over HTTPS. |
+| **T1036** | Masquerading | Uses legitimate-looking filenames and metadata to disguise the payload. |
+| **T1497** | Virtualization/Sandbox Evasion | Detects virtualized or sandboxed environments before executing the payload. |
+| **T1082** | System Information Discovery | Collects basic host information before processing attacker commands. |