Lesson checkpoints
Two questions per lesson. You need 100% to unlock the next lesson. Retries are unlimited with a 30-second cooldown.
Course · Free
UNC4736 APT Adversary Emulation
3CX / VEILEDSIGNAL Supply-Chain Campaign
Reconstruct a complete adversary-emulation chain from the source monograph. Ten labs, fourteen source files, and a checkpoint after every lesson.
10 modules 56 lessons ~4 hours 10 labs
About the course
Read the chain, not a summary of it
The course is built directly from the 239-page monograph. The technical analysis, tables, diagrams, and source listings are preserved. Formatting has been cleaned up for the web; the facts and code behavior are unchanged.
Each module asks one engineering question and answers it with a lab. The lessons walk through the code line by line, then connect the implementation back to the campaign and to MITRE ATT&CK.
What you need
- A Google account for sign-in.
- Comfort reading C/C++ and JavaScript.
- An authorized, controlled environment for any hands-on work.
- No payment. No separate password.
This is offensive-security engineering material. Do not use any technique against systems you do not own or have explicit written permission to test.
Syllabus
Enroll free10 modules · 56 lessons
Lessons unlock in order. A lesson checkpoint requires a perfect score; a module assessment requires 80%. Completed content stays available.
Hidden IFRAME
How does a watering hole reach a victim who does nothing wrong?
- 01 · The 3CX watering-hole case
- 02 · Technical aspects of the chain
- 03 · index.html — the hidden frame
- 04 · exploit.html — browser profiling and heap spray
- Module assessment · 6 questions · 80% to pass
Use-After-Free (UAF)
How does a browser bug become arbitrary code execution?
- 01 · uaf_real.cpp — the complete model
- 02 · Walkthrough: headers and the single-slot allocator
- 03 · Walkthrough: the victim object and vtables
- 04 · Walkthrough: create, remove, spray, trigger
- 05 · Walkthrough: main
- 06 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Send Implant Data
What does the attacker learn before they act?
- 01 · implant_data.c — the complete implant
- 02 · Walkthrough: headers and host collectors
- 03 · Walkthrough: network collection and exfiltration
- 04 · Walkthrough: main and the C2 fallback
- 05 · c2_listener.py — the receiving side
- Module assessment · 6 questions · 80% to pass
Execute Shellcode
How do you run your own bytes in someone else's process?
- 01 · exec_shellcode.c — the complete assembler
- 02 · Walkthrough: headers and emit
- 03 · Walkthrough: build_shellcode
- 04 · Walkthrough: execute_shellcode
- 05 · Walkthrough: main and external verification
- 06 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Terminate Itself
How do you leave nothing behind?
- 01 · self_kill.c — the complete self-deletion implant
- 02 · Walkthrough: headers
- 03 · Walkthrough: batch_self_delete
- 04 · Walkthrough: reboot and direct deletion
- 05 · Walkthrough: terminate_self
- 06 · Walkthrough: main
- 07 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Injection Target
Why hide in a browser?
- 01 · find_target.c — the complete target finder
- 02 · Walkthrough: headers, Target, and full_path
- 03 · Walkthrough: find_target
- 04 · Walkthrough: main
- 05 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Injection Content
How do you get code into another process?
- 01 · inject.c — the complete injector
- 02 · Walkthrough: headers and build_shellcode
- 03 · Walkthrough: inject
- 04 · Walkthrough: main
- 05 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Resilience Mechanism
How do you survive the host killing your channel?
- 01 · resilience.c — the complete resilience loop
- 02 · Walkthrough: headers, constants, and Target
- 03 · Walkthrough: full_path and find_browser
- 04 · Walkthrough: build_c2_module
- 05 · Walkthrough: inject_module
- 06 · Walkthrough: pipe_alive and monitor_thread
- 07 · Walkthrough: main
- 08 · Logic flow and first principles
- Module assessment · 6 questions · 80% to pass
Internal Communication (Named Pipe)
How do you talk to your implant without touching the network?
- 01 · pipe_server.c — the complete pipe server
- 02 · Walkthrough: headers, constants, and client_thread
- 03 · Walkthrough: main
- 04 · Logic flow and first principles
- 05 · pipe_client.c — the pipe client
- Module assessment · 6 questions · 80% to pass
External Communication (AES-256-GCM)
How does your traffic look like the victim's browser?
- 01 · aes_gcm.c — the complete encryptor and sender
- 02 · Walkthrough: headers, constants, and encrypt_gcm
- 03 · Walkthrough: main and the send path
- 04 · Logic flow and first principles
- 05 · gcm_receiver.py — the receiving side
- Module assessment · 6 questions · 80% to pass
Assessment
How completion works
Module assessments
Six questions per module. You need 80% to unlock the next module. Answers and answer keys are scored on the server.
Final assignment
After all ten modules, the assignment instructions unlock. You email your original research for manual review. Completion does not guarantee certificate approval.
Ready to start?
Free enrollment. Google sign-in. No payment details.