diff --git a/North Koreans APT/Ricochet Chollima/README.md b/North Koreans APT/Ricochet Chollima/README.md
index ecaa27b..cb4f08c 100644
--- a/North Koreans APT/Ricochet Chollima/README.md
+++ b/North Koreans APT/Ricochet Chollima/README.md
@@ -25,10 +25,7 @@ The attacker impersonated a North Korea-focused expert based in South Korea, and
4. Toy.Bat: When the PowerShell command in “toy03.bat” file is executed, it loads “toy02.dat” file created in temporary folder, functioning as a loader.
-5. shellcode injection: As a result the shellcode is loaded into memory and the memory area becomes executable.
-
-
-6. Dropbox C2: Get Command and Control through payload uses the Dropbox API to upload data including command output to Dropbox.
+5. Dropbox C2: Get Command and Control through payload uses the Dropbox API to upload data including command output to Dropbox.
@@ -77,3 +74,17 @@ As a result, the shellcode is loaded into memory and the memory area becomes exe
+## The fifth stage (Data Exfiltration) over Dropbox API C2 Channe
+
+The attackers used the Dropbox C2 (Command and Control) API as a means to establish a communication channel between their payload and the attacker's server. By using Dropbox as a C2 server, attackers can hide their malicious activities among the legitimate traffic to Dropbox, making it harder for security teams to detect the threat.
+
+
+
+First, I need to create a Dropbox account and activate its permissions, as shown in the following figure.
+
+
+
+After that, I will go to the settings menu to generate the access token for the Dropbox account, and this is what we will use in Dropbox C2.
+
+
+