Ricochet Chollima APT Adversary Simulation
This is a simulation of an attack by the (Ricochet Chollima) APT group, targeting several activists focused on North Korea. The attack campaign began in March 2025. The attack chain started with spear-phishing. The email contained a Dropbox link leading to a compressed archive that included a malicious shortcut (LNK) file. When extracted and executed, the LNK file activated additional malware containing the keyword "toy." The content was disguised as an academic forum invitation from a South Korean national security think tank to attract attention.
This simulation is based on research from Genians: https://www.genians.co.kr/en/blog/threat_intelligence/toybox-story
Based on the characteristics of the threat, Genians Security Center (GSC) named the campaign “Operation: ToyBox Story”
The attacker impersonated a North Korea-focused expert based in South Korea, and the email used the subject line “러시아 전장에 투입된 인민군 장병들에게.hwp” (To North Korean People’s Army Soldiers Deployed to the Russian Battlefield.hwp) with the attachment carrying the same file name, the attachment mimicked a Hangul (HWP) document by displaying the HWP icon image used by Naver Mail, and the attacker leveraged this icon to make the attachment appear as a legitimate file link, however the actual download link redirected to Dropbox, which led to a ZIP archive named “러시아 전장에 투입된 인민군 장병들에게.zip” (To North Korean People’s Army Soldiers Deployed to the Russian Battlefield.zip).
-
Delivery Technique: Create document file masquerading as information on North Korean troops deployed to Russia.
-
Malicious shortcut: make single shortcut (LNK) file. This LNK file executes malicious code and shares the same name as the ZIP archive, with only the file extension being different.
-
PowerShell Commands: The shortcut (LNK) file is configured to run via PowerShell commands embedded arguments.
-
Toy.Bat: When the PowerShell command in “toy03.bat” file is executed, it loads “toy02.dat” file created in temporary folder, functioning as a loader.
-
shellcode injection: As a result the shellcode is loaded into memory and the memory area becomes executable.
-
Dropbox C2: Get Command and Control through payload uses the Dropbox API to upload data including command output to Dropbox.