UNC4736 APT Adversary Emulation — 3CX / VEILEDSIGNAL Supply-Chain Campaign
A text-first engineering course that reconstructs a real supply-chain intrusion. You will read the actual source files, understand why each stage exists, and prove your understanding at every step.
One complete course, built from the 239-page monograph. Every lesson, table, diagram, and source listing is preserved.
3CX / VEILEDSIGNAL Supply-Chain Campaign
Rebuild a complete adversary-emulation chain from first principles: browser exploitation, shellcode execution, process injection, resilient C2, and authenticated command channels. Every lab is tied back to the source monograph and a MITRE ATT&CK technique.
Progress is stored and enforced on the server. Editing the page, changing a URL, or clearing browser storage does not unlock content.
One click creates your account. There is no password to choose, reset, or leak.
Each lesson unlocks the next. Completed lessons stay available for review at any time.
Two questions per lesson confirm the idea before the next lesson opens. Retries are unlimited.
Six questions per module, 80% to pass. The next module unlocks only after the assessment passes.
After all ten modules, the final assignment opens. Submission and review happen by email.
The goal is engineering understanding, not trivia. Each assessment question is grounded in the lesson that precedes it.
Follow the 3CX / VEILEDSIGNAL chain from a hidden IFRAME on a vendor site to a signed installer.
Work through 14 source files line by line, including the UAF model, shellcode loader, and C2 modules.
Understand delivery, collection, execution, injection, resilience, named pipes, and authenticated C2.
Connect each stage to MITRE ATT&CK techniques and the evidence defenders can observe.
The course follows the monograph's lab order. Each module maps to a MITRE ATT&CK technique and ends with a six-question assessment.
How does a watering hole reach a victim who does nothing wrong?
How does a browser bug become arbitrary code execution?
What does the attacker learn before they act?
How do you run your own bytes in someone else's process?
How do you leave nothing behind?
Why hide in a browser?
How do you get code into another process?
How do you survive the host killing your channel?
How do you talk to your implant without touching the network?
How does your traffic look like the victim's browser?
Yes. The course price is Free / $0. You need a Google account to sign in, but there is no payment step.
Authentication is delegated to Google. The site never receives or stores your Google password, and there is no separate password to reset or leak. We receive your name, email address, and profile photo.
Lesson checkpoints and module assessments are scored on the server. The next lesson or module unlocks only after the server records a pass. Completed content remains revisitable.
No. Completing all ten modules makes you eligible to submit the final assignment for manual review. The evaluator decides whether to approve the submission or request changes.
The material is offensive-security engineering. All research and demonstrations must be conducted in authorized, controlled environments. Do not use any technique against systems you do not own or have explicit permission to test.
Free enrollment. Google sign-in. Server-enforced progression.
