Chollima APT Hackers Weaponize LNK File to Deploy Sophisticated Malware

Cybersecuritynews • February 3, 2026

Share: View original

Ricochet Chollima targeted NK activists via spear-phishing emails, posing as experts and using Dropbox links to deliver malware-laced files.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chollima APT Targets Activists with LNK File Malware in Operation: ToyBox Story The Ricochet Chollima APT group has initiated a campaign against activists and organizations focused on North Korea, starting in March 2025. This operation, dubbed 'Operation: ToyBox Story,' employs social engineering tactics and malware delivered via spear-phishing emails that appear legitimate to the recipients. 4 sources 43

Extracted Entities

APT Groups (1)

Attack Types (2)

Malware Phishing

MITRE ATT&CK (1)

T1566 - Phishing

Platforms (1)