APTs-Adversary-Simulation/North Koreans APT/Famous Chollima

Famous Chollima APT Adversary Simulation

This is a simulation of attack by (Famous Chollima) APT group targeting job seekers to accomplish their goals and wide variety of United States (US) companies, the attack campaign was active early as December 2022, The attack chain starts with attackers invites the victim to participate in an online interview. The attackers likely uses video conferencing or other online collaboration tools for the interview. During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The actors likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor malware. I relied on paloalto unit42 to figure out the details to make this simulation: https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/

This attack included several stages including During the interview, the attackers convinces the victim to download and install an NPM-based package hosted on GitHub. The attackers likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim’s host with backdoor.

HackerNews: https://thehackernews.com/2023/11/north-korean-hackers-pose-as-job.html

1. Social Engineering Technique: The Attackers attempts to infect software developers with malware through a fictitious job interview.

2. GitHub Abuse (Supply-Chain): The Attackers exploited GitHub, a trusted platform used daily by developers, to deliver or distribute malicious packages, leveraging its legitimacy and widespread adoption. When developers clone and run the project, the malware executes in their environment.

3. NPM-based package hosted on GitHub: Create obfuscated JavaScript-based payload hidden inside Node Package Manager (NPM) packages. InvisibleFerret is a simple but Python-based backdoor. Both are cross-platform malware that can run on Windows, Linux and macOS.

4. Python backdoor: The component for InvisibleFerret deploys remote control and information stealing capabilities. Once executed, it prepares the environment by installing the Python packages, if they are not already present on the system.

5. TCP-C2 Server with XOR key: The C2 server returns JSON data instructing the backdoor with the next actions to take. The JSON response contains the same XOR key.

The first stage (Social Engineering Technique)

The attackers lure their victims by inviting them to job interviews. In other cases, the attackers themselves apply for jobs using fake identities. They exploit the idea that people are in need of work or are seeking better opportunities, impersonating individuals applying for a position at a company. This is a clever tactic, as exploiting resources is far more valuable than just simply using them.

The logic behind this type of attack lies in the idea that instead of launching a direct attack on a company, an attacker can target an individual such as someone who was recently laid off and is actively seeking job opportunities. This person might still have access credentials to their former company’s email or possess sensitive company information. By compromising them, the attacker can gain indirect access to the organization.

Additionally, even without these specific circumstances, the second part of the logic is that many individuals in the IT and software development community commonly look for freelance work alongside their main job. This is a perfectly normal behavior, making it a natural and less suspicious entry point for attackers to exploit.

The second stage (delivery technique GitHub-Abuse)

The attackers took advantage of the fact that their victims were part of the software development and IT community, possessing technical expertise and regularly working with GitHub. At the same time, using an open source project during a technical interview doesn’t seem unusual. Asking the victim to share their screen and test some code to assess their technical skills appeared to be a reasonable and clever tactic, especially when targeting victims from the IT field.

However, in some of the repositories created by the attackers, they forgot to disable comments on the project. As a result, some users and security researchers discovered the malicious technique and left comments on the repository warning that it contained malware and should not be used. This mistake was not identified early enough. Additionally, there were other repositories where the attackers should have deleted the comments after uploading the malicious code.

The third stage (implanting technique NPM-package)

The attackers created an NPM package that, in turn, executes obfuscated JavaScript code, You can use these commands to create the NPM package.json file.

sudo apt-get install npm

mkdir my-malicious-package
cd my-malicious-package
npm init -y

Now i will create the JavaScript file using the command touch payload.js. Then, i paste the following code inside it, which contains only the whoami command just to test that everything is working correctly before adding the main payload and obfuscate Java Script code.

The fourth stage (Python Backdoor)

The attackers created a simple payload that performs two main tasks:

1.The first task is establishing a connection to a C2 server over TCP with XOR encryption.

2.The second task is stealing credentials from the victim's browser.

This Python payload creates a reverse TCP shell that connects to a command-and-control (C2) server.

1. The script imports libraries for socket communication, subprocess execution, base64 encoding, and web browser interaction.

2. It defines XOR encryption/decryption functions to secure data exchange with a hardcoded key.

3. Upon execution, it opens url in a web browser and establishes a TCP connection to a specified C2 server (ip:port).

4. The script authenticates with the server, receives encrypted commands, executes them locally, and sends back encrypted results.

The question here is: Why do attackers choose Python, even though it is not a built-in language in Windows like PowerShell scripts or CMD, meaning it cannot run without installing the necessary packages?

The answer lies in the target itself mainly software engineers. These individuals already have all the required packages installed, as Python is one of the most commonly used programming languages. Additionally, Python offers another advantage: scripts can be as short as just 60 lines, making modifications to any script hosted on GitHub nearly undetectable with obfuscated JavaScript and deleted the comments after uploading the malicious code.

The fifth stage (execution technique with obfuscated JavaScript-based payload hidden inside NPM)

Now i will replace the whoami command with the actual payload inside the JavaScript file and obfuscate it using BEAR-C2.

Now I will open the obfuscation tool included in BEAR-C2, select the JavaScript file to obfuscate it, then upload the payload to GitHub and begin the Command and Control operation.

The JavaScript file is now obfuscated using the built-in obfuscation tool provided by BEAR-C2.

It's important to ensure that the payload file has the same name as defined inside the NPM package before uploading it to GitHub.

The final result is the successful establishment of a Command and Control channel. This is achieved by delivering a phishing link that mimics Microsoft login pages using BEAR-C2’s phishing module combined with an obfuscated JavaScript payload. Once executed, the payload initiates a reverse TCP connection to the attacker’s server, encrypted with XOR, allowing secure data exfiltration and remote command execution.

https://github.com/user-attachments/assets/29d59e74-cdf5-464a-bd0d-8a151a9d762e

MITRE ATT&CK Techniques

Technique ID	Technique	Implementation
T1566.002	Phishing: Spearphishing Link	Delivers a phishing link that impersonates a Microsoft login page to target job seekers.
T1583.001	Acquire Infrastructure: Domains	Uses attacker-controlled phishing domains to host the interview lure.
T1195.001	Supply Chain Compromise	Distributes a malicious NPM package hosted on GitHub as interview software.
T1059.007	Command and Scripting Interpreter: JavaScript	Executes an obfuscated JavaScript payload embedded inside the NPM package.
T1027	Obfuscated Files or Information	JavaScript payload is obfuscated using the built-in BEAR C2 obfuscation engine.
T1105	Ingress Tool Transfer	Downloads the secondary payload from GitHub after the JavaScript executes.
T1573.001	Encrypted Channel: Symmetric Cryptography	Protects C2 communications using XOR encryption.
T1095	Non-Application Layer Protocol	Establishes a Reverse TCP channel for command and control.
T1071	Application Layer Protocol	Uses GitHub as the payload delivery platform during the initial infection stage.
T1102.001	Web Service: Dead Drop Resolver	Leverages GitHub as a trusted web service for payload hosting and retrieval.