From b75b5f42a3dee77714ac6a3d38173fe7103135b8 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Mon, 25 Aug 2025 16:39:02 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Ricochet Chollima/README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/North Koreans APT/Ricochet Chollima/README.md b/North Koreans APT/Ricochet Chollima/README.md
index 52db7c7..6142810 100644
--- a/North Koreans APT/Ricochet Chollima/README.md	
+++ b/North Koreans APT/Ricochet Chollima/README.md	
@@ -42,3 +42,12 @@ The decoy HWP document contains a letter addressed to North Korean soldiers depl
 
 <img width="586" height="714" alt="imageedit_2_7840143710" src="https://github.com/user-attachments/assets/928315fd-596a-4906-9024-4a2b1017e974" />
 
+
+## The second stage (Malicious shortcut)
+
+The archive named “관련 포스터.zip” (Related Poster.zip) contained a benign JPG image alongside a malicious LNK shortcut. Upon execution of the LNK file, a hidden PowerShell command embedded within the shortcut was triggered, initiating the malicious activity. 
+
+
+
+
+