VENOMOUS BEAR APT ADVERSARY SIMULATION

Summary from the TLDR InfoSec newsletter

This blog discusses a simulation of an attack by the Venomous Bear APT group that targeted countries like the USA and Germany from at least 2020. The attackers used a fake Microsoft Windows Time service to install a backdoor that allowed them to exfiltrate files and communicate with a command and control server. The simulation includes stages for installing the backdoor using a .bat file, developing the backdoor DLL, and creating a listener script for receiving commands from the backdoor.