From fda431708a31082799eecd94ef00765c4cf1c593 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sun, 6 Jul 2025 01:15:27 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Famous Chollima/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/North Koreans APT/Famous Chollima/README.md b/North Koreans APT/Famous Chollima/README.md
index 7158543..daf2500 100644
--- a/North Koreans APT/Famous Chollima/README.md	
+++ b/North Koreans APT/Famous Chollima/README.md	
@@ -3,3 +3,4 @@
 This is a simulation of attack by (Famous Chollima) APT group targeting job seekers to accomplish their goals and wide variety of United States (US) companies, the attack campaign was active early as December 2022, The attack chain starts with attackers invites the victim to participate in an online interview. The attackers likely uses video conferencing or other online collaboration tools for the interview. During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The threat actor likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor malware. I relied on paloalto unit42 to figure out the details to make this https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
 
 
+![imageedit_4_8185813077](https://github.com/user-attachments/assets/cba7dd9b-d0e8-4b9c-b47a-7c413d8f91e5)