Chollima APT Hackers Weaponize LNK File to Deploy Sophisticated Malware
The Ricochet Chollima advanced persistent threat group initiated a targeted campaign against activists and organizations focusing on North Korea in March 2025.
The Ricochet Chollima advanced persistent threat group initiated a targeted campaign against activists and organizations focusing on North Korea in March 2025.
The operation, termed "Operation: ToyBox Story" by Genians Security Center, employs a combination of social engineering and malware delivery tactics.
Attackers distribute spear-phishing emails impersonating North Korea-focused security experts. These emails include Dropbox links to compressed archives containing malicious Windows shortcut files. Victims inadvertently download files that execute hidden code upon opening.
The attack is sophisticated, using culturally relevant email subject lines and Hangul document icons to increase engagement and disguise the malicious content.
This approach relies on social engineering, exploiting users' trust in familiar file icons and organizations.
The operation, termed "Operation: ToyBox Story" by Genians Security Center, employs a combination of social engineering and malware delivery tactics.
An Offensive Security Engineer, S3N4T0R, analyzed the campaign and identified the malware's progression through multiple stages, designed to evade security tools and maintain persistence.
Fileless Execution Through Memory Injection
The malware's key threat is its fileless execution capability, which leaves no traces on the hard drive. A hidden PowerShell command within the shortcut executes silently when the ZIP archive is extracted and the document file is opened.
This command triggers a batch file named "toy03.bat," which loads "toy02.dat" from the temporary folder. The loader decodes XOR-transformed data and injects shellcode directly into memory, bypassing traditional detection methods.
Once in memory, the malware creates a new executable thread to run the injected code. This fileless malware execution technique poses significant challenges for security teams, as it leaves minimal evidence on disk.
The malware then communicates via Dropbox API channels, allowing attackers to send commands and receive stolen data while concealing activities within legitimate cloud service traffic.
This technique represents a significant advancement in APT tactics, utilizing trusted services to obscure malicious operations and complicate detection efforts for defenders.
Based on reporting by Cyber Security News.