From f1ec872925865cb9d963a6e57017b81634ea08d9 Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Sun, 24 Aug 2025 18:18:21 -0400
Subject: [PATCH] Update README.md

---
 North Koreans APT/Ricochet Chollima/README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/North Koreans APT/Ricochet Chollima/README.md b/North Koreans APT/Ricochet Chollima/README.md
index 2988357..a5187c1 100644
--- a/North Koreans APT/Ricochet Chollima/README.md	
+++ b/North Koreans APT/Ricochet Chollima/README.md	
@@ -12,5 +12,8 @@ The attacker impersonated a North Korea-focused expert based in South Korea, and
 
 <img width="702" height="354" alt="imageedit_3_2570117683" src="https://github.com/user-attachments/assets/cf10354c-b377-4baf-b217-76f01b353f15" />
 
+1. Social Engineering Technique: Create document file  masquerading as information on North Korean troops deployed to Russia.
 
 
+2. malicious shortcut: make single shortcut (LNK) file. This LNK file executes malicious code and shares the same name as the ZIP archive, with only the file extension being different.
+