Chollima Hackers Abuse LNK Files In Sophisticated Malware Campaign

Cyberpress • February 3, 2026

Share: View original

North Korea-linked Ricochet Chollima hackers launched a targeted spear-phishing attack in March 2025 against activists monitoring the regime.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chollima APT Targets Activists with LNK File Malware in Operation: ToyBox Story The Ricochet Chollima APT group has initiated a campaign against activists and organizations focused on North Korea, starting in March 2025. This operation, dubbed 'Operation: ToyBox Story,' employs social engineering tactics and malware delivered via spear-phishing emails that appear legitimate to the recipients. 4 sources 43

Extracted Entities

APT Groups (2)

Chollima Hackers Ricochet Chollima

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

T1566 - Phishing