5.0 KiB
Velvet Chollima APT Adversary Simulation
This is a simulation of an attack by the (Velvet Chollima) APT group targeting South Korean government officials. The attack campaign began in January 2025 and also targeted NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia. The attack chain starts with a spear-phishing email containing a PDF attachment. However, when targets attempt to read the document, they are redirected to a Fake-Captcha link instructing them to run PowerShell as an administrator and execute attacker-provided code. This simulation is based on research from Microsoft's Threat Intelligence and Bleeping Computer: https://www.bleepingcomputer.com/news/security/dprk-hackers-dupe-targets-into-typing-powershell-commands-as-admin/
The attackers used a new tactic known as ClickFix, a social engineering technique that has gained traction, particularly for distributing malware.
ClickFix involves deceptive error messages or prompts that trick victims into executing malicious code themselves, often via PowerShell commands, ultimately leading to malware infections.
Microsoft's Threat Intelligence: https://x.com/MsftSecIntel/status/1889407814604296490
According to Microsoft's Threat Intelligence team, the attackers masquerade as South Korean government officials, gradually building trust with their targets. Once a certain level of rapport is established, the attacker sends a spear-phishing email with a PDF attachment. However, when targets attempt to read the document, they are redirected to a fake device registration link that instructs them to run PowerShell as an administrator and execute attacker-provided code.
-
Social Engineering: Create PDF file which will be sent spear-phishing.
-
ClickFix Technique: (Fake-Captcha) to make the target run PowerShell as an administrator and paste attacker-provided code.
-
Reverse Shell: Make simple reverse shell (payload.ps1) to creates a TCP connection to a command and control (C2) server and listens for commands to execute on the target machine.
The first stage (delivery technique)
First the attackers created PDF file includes a Hyperlink that leads to a (Fake-Captcha) page, The advantage of the hyperlink is that it does not appear in texts, and this is exactly what the attackers wanted to exploit.
The second stage (Fake-Captcha)
This file is a fake CAPTCHA verification page, designed as part of a phishing attack or malicious script execution.
If you need know more about fake CAPTCHA: https://www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/
Here’s what it does:
- Fake Verification Interface
The page displays a message prompting the user to verify that they are not a robot. The design mimics a legitimate CAPTCHA verification page but is actually completely fake.
- Social Engineering Trick
When the user clicks the checkbox ("I'm not a robot"), the verify() function in JavaScript is triggered. This function displays a popup instructing the user to execute specific commands in PowerShell.
- Execution of Malicious PowerShell Code
The script automatically copies a PowerShell command to the clipboard. If the user follows the instructions and executes the code, it: Establishes a reverse shell connection to IP:PORT.
Allows the attacker to remotely execute commands on the victim’s machine. Persists by adding itself to the Windows registry (Run Key), ensuring execution every time the system starts.
The third stage (Reverse shell by PowerShell)
The final result of this fake CAPTCHA attack is that the attacker gains remote access to the victim's machine through a reverse shell connection. Once the victim unknowingly runs the copied PowerShell command, their system establishes a connection to the attacker's server, allowing remote command execution.
This access enables the attacker to control the system, extract sensitive data, install additional malware, and potentially spread within a network if the victim is part of a corporate environment. To ensure persistence, the script modifies the Windows registry so that the malicious command runs every time the system starts. Even after a reboot, the attack remains active.