Chollima APT Targets Activists with LNK File Malware in Operation: ToyBox Story

First seen 3 Feb 2026, 16:06 UTC • Gbhackers

•43

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Ricochet Chollima APT group has initiated a campaign against activists and organizations focused on North Korea, starting in March 2025. This operation, dubbed 'Operation: ToyBox Story,' employs social engineering tactics and malware delivered via spear-phishing emails that appear legitimate to the recipients.

How this analysis works

Attack Flow

9 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (4)

Chollima
Chollima APT Hackers
Chollima Hackers
Ricochet Chollima

Technique (3)

Malware
Phishing
T1566 - Phishing

Campaign (1)

Operation: ToyBox Story

Affected Platform (1)

Ricochet

Relationships

Chollima uses Malware
Chollima uses Phishing
Chollima uses T1566 - Phishing
Chollima APT Hackers uses Malware
Chollima APT Hackers uses Phishing
Chollima APT Hackers uses T1566 - Phishing
Chollima Hackers uses Malware
Chollima Hackers uses Phishing
Chollima Hackers uses T1566 - Phishing
Ricochet Chollima uses Malware
Ricochet Chollima uses Phishing
Ricochet Chollima uses T1566 - Phishing
Operation: ToyBox Story attributed to Chollima
Operation: ToyBox Story attributed to Chollima APT Hackers
Operation: ToyBox Story attributed to Chollima Hackers
Operation: ToyBox Story attributed to Ricochet Chollima
Chollima related to Ricochet

Continue Reading

North Korean ClickFake Campaign Targets Web3 Professionals with RATs Ukrainian Sentenced for Aiding North Korean Cyber Operations

Chollima APT Targets Activists with LNK File Malware in Operation: ToyBox Story

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading