Chollima APT Hackers Weaponize LNK File to Deploy Sophisticated Malware

Cybersecuritynews •Tushar Subhra Dutta • February 3, 2026

The Ricochet Chollima advanced persistent threat group has launched a targeted campaign against activists and organizations focused on North Korea, beginning in March 2025. The operation, named “Operation: ToyBox Story” by Genians Security Center, relies on a clever combination of social engineering and malware delivery tactics. Attackers send spear-phishing emails that appear to come from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chollima APT Targets Activists with LNK File Malware in Operation: ToyBox Story The Ricochet Chollima APT group has initiated a campaign against activists and organizations focused on North Korea, starting in March 2025. This operation, dubbed 'Operation: ToyBox Story,' employs social engineering tactics and malware delivered via spear-phishing emails that appear legitimate to the recipients. 4 sources 43

Extracted Entities

Chollima APT Hackers Weaponize LNK File to Deploy Sophisticated Malware

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Campaigns (1)

Countries (1)

MITRE ATT&CK (1)