From 451375924996a52780031c26d53a41b2266d7d6f Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Fri, 10 Oct 2025 16:51:39 -0400
Subject: [PATCH] Update README.md
---
North Koreans APT/Ricochet Chollima/README.md | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/North Koreans APT/Ricochet Chollima/README.md b/North Koreans APT/Ricochet Chollima/README.md
index ecaa27b..cb4f08c 100644
--- a/North Koreans APT/Ricochet Chollima/README.md
+++ b/North Koreans APT/Ricochet Chollima/README.md
@@ -25,10 +25,7 @@ The attacker impersonated a North Korea-focused expert based in South Korea, and
4. Toy.Bat: When the PowerShell command in “toy03.bat” file is executed, it loads “toy02.dat” file created in temporary folder, functioning as a loader.
-5. shellcode injection: As a result the shellcode is loaded into memory and the memory area becomes executable.
-
-
-6. Dropbox C2: Get Command and Control through payload uses the Dropbox API to upload data including command output to Dropbox.
+5. Dropbox C2: Get Command and Control through payload uses the Dropbox API to upload data including command output to Dropbox.
@@ -77,3 +74,17 @@ As a result, the shellcode is loaded into memory and the memory area becomes exe
+## The fifth stage (Data Exfiltration) over Dropbox API C2 Channe
+
+The attackers used the Dropbox C2 (Command and Control) API as a means to establish a communication channel between their payload and the attacker's server. By using Dropbox as a C2 server, attackers can hide their malicious activities among the legitimate traffic to Dropbox, making it harder for security teams to detect the threat.
+
+
+
+First, I need to create a Dropbox account and activate its permissions, as shown in the following figure.
+
+
+
+After that, I will go to the settings menu to generate the access token for the Dropbox account, and this is what we will use in Dropbox C2.
+
+
+