Labyrinth Chollima APT Adversary Simulation
This is a simulation of attack by (Labyrinth Chollima) APT group targeting victims working on energy company and the aerospace industry, the attack campaign was active before June 2024, The attack chain starts with relies on legitimate job description content to target victims employed in U.S. critical infrastructure verticals. The job description is delivered to the victim in a password-protected ZIP archive containing an encrypted PDF file and a modified version of an open-source PDF viewer application, I relied on Mandiant to figure out the details to make this simulation: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-reader/?linkId=10998021
Based on the surrounding context, the user was instructed to open the PDF file with the enclosed trojanized PDF viewer program based on the open-source project SumatraPDF.
SumatraPDF is an open-source document viewing application that is capable of viewing multiple document file formats such as PDF, XPS, and CHM, along with many more. Its source code is publically available. If you need to know more about SumatraPDF: https://github.com/sumatrapdfreader/sumatrapdf
When accessed this way, the DLL files are loaded by the SumatraPDF.exe executable, including the trojanized libmupdf.dll file representing the first stage of the infection chain. This file is responsible for decrypting the contents of BAE_Vice President of Business Development.pdf, thus allowing the job description document to be displayed as well as loading into memory the payload named MISTPEN. Mandiant found that later versions (after 3.4.3) of SumatraPDF implement countermeasures to prevent modified versions of this DLL from being loaded.
1.Create job description PDF file which will be sent spear phishing.
The first stage (delivery technique)
Since the attackers here wanted to target victims working on energy company and the aerospace industry, The attack starts with relies on legitimate job description content to target victims employed in U.S, Now I will create a pdf file with the same phishing message that the actual attackers used in their phishing campaign.
The Second stage (implanting technique)
Now I need to download the SumatraPDF program before version 3.4.3, so I chose version 3.4.1 because after 3.4.3 of SumatraPDF implement countermeasures to prevent modified versions of this DLL from being loaded.
uptodown to download the old version: https://sumatra-pdf-portable.en.uptodown.com/windows/download/62634650
After that I will use Shellter to inject DLL in the Sumatra pdf.exe which I will use in the attack through the pdf file that is used in the phishing campaign.
After injecting the malicious DLL into (SumatraPDF.exe), I will bundle it with a non-malicious (job description.pdf) file inside a ZIP archive. When the user open the ZIP file, it will trigger the background execution of the injected (SumatraPDF.exe), which will establish a reverse connection.
In a previous simulation of a Russian APT, I used a similar approach but with an image file instead of a PDF. We will replicate the same method now but without selecting the icon.
The third stage (execution technique)
Now, when I open the ZIP file, it executes the PDF file while simultaneously running (SumatraPDF.exe) in the background. This executable contains the DLL payload, through which I will establish the reverse connection.
The fourth stage (Data Exfiltration)
In simulating this attack, I used the sixth C2 profile found in BEAR-C2.
https://github.com/S3N4T0R-0X0/BEAR