Chollima APT Hackers Weaponize LNK Files to Deploy Sophisticated Malware
In March 2025, the Ricochet Chollima APT group, also known as APT37, launched a targeted spear-phishing campaign against activists focused on North Korean affairs. This group is linked to North Korean state-sponsored operations.
In March 2025, the Ricochet Chollima APT group, also known as APT37, launched a targeted spear-phishing campaign against activists focused on North Korean affairs. This group is linked to North Korean state-sponsored operations.
The attackers initiated the attack chain using spear-phishing emails that impersonated a security expert based in South Korea. These emails referenced legitimate topics, such as North Korean troops deployed to Russia and a national security conference hosted by a South Korean think tank, to establish credibility.
The campaign, identified as "Operation: ToyBox Story" by Genians Security Center, utilized sophisticated techniques, including LNK file exploitation and fileless malware execution, to evade traditional security solutions. The malicious emails contained Dropbox links that redirected victims to compressed ZIP archives containing weaponized LNK shortcut files.
The attack employed a carefully orchestrated delivery technique. The first documented case occurred on Tue, Mar 8, 2025, with an email titled "To North Korean Soldiers Deployed to the Russian Battlefield.hwp." The attachment mimicked a legitimate Hangul (HWP) document but redirected to Dropbox instead of delivering the claimed document.
Upon extraction, victims discovered a ZIP archive containing a malicious LNK file that shared the same name as the archive, differing only in file extension. A secondary campaign variant on Fri, Mar 11, 2025, used a "Related Poster.zip" archive containing both a benign JPG image and a malicious LNK shortcut file.
The attackers initiated the attack chain using spear-phishing emails that impersonated a security expert based in South Korea.
The LNK file embedded hidden PowerShell commands designed to execute automatically upon activation. When triggered, the shortcut launched a multi-stage payload delivery process, creating temporary files in the %Temp% directory and executing a BAT batch file while displaying a decoy HWP document.
This process involved loading "toy02.dat" as a loader, which then loaded "toy01.dat" from the temporary folder. These files contained XOR-transformed data that, when decoded, was injected into memory as executable shellcode. This fileless technique allowed runtime malware injection and dynamic code execution without writing malicious binaries to disk, effectively bypassing signature-based endpoint detection systems.
The final payload deployed the RoKRAT remote access trojan, which collected extensive system information, including Windows OS build version, computer name, user credentials, BIOS version, and system manufacturer. RoKRAT captured real-time screenshots and exfiltrated data through encrypted channels using AES-CBC-128 encryption, with AES keys further secured via RSA encryption.
Notably, the malware leveraged Dropbox as a command-and-control server, using cloud API services to hide malicious traffic among legitimate Dropbox communications. This "Living off Trusted Sites" (LoTS) technique complicated detection by security teams analyzing network traffic.
Organizations are advised to prohibit LNK file execution from email attachments and implement endpoint detection and response (EDR) solutions capable of monitoring fileless attacks through behavioral anomaly detection. The campaign demonstrates APT37's continued sophistication in exploiting legitimate cloud services to maintain persistent access while evading traditional security controls.
Based on reporting by GBHackers.