North Korea-linked Ricochet Chollima hackers launched a targeted spear-phishing attack in March 2025 against activists monitoring the regime.
Dubbed “Operation: ToyBox Story” by Genians Security Center (GSC), the campaign weaponized malicious LNK shortcut files hidden in Dropbox archives.
Posing as a South Korean national security expert, the APT group tricked victims with emails mimicking invitations to academic forums on North Korea.
The attack preyed on interest in sensitive topics. Emails used the subject “러시아 전장에 투입된 인민군 장병들에게.hwp” (“To North Korean People’s Army Soldiers Deployed to the Russian Battlefield.hwp”).
Attachments displayed a fake Hangul HWP icon from Naver Mail to look legitimate. But clicking led to a Dropbox ZIP archive named “러시아 전장에 투입된 인민군 장병들에게.zip”. Inside waited the malicious payload, blending deception with stealthy execution.
Initial Delivery and LNK Activation
Victims downloaded archives like “관련 포스터.zip” (“Related Poster.zip”), which held a decoy JPG image and a booby-trapped LNK shortcut matching the ZIP name but with a .lnk extension.
Extracting and double-clicking the LNK triggered hidden PowerShell commands. These silently ran without alerts, evading basic antivirus scans.
Genians analysis revealed the LNK targeted Windows users via PowerShell arguments. It dropped files like “toy03.bat” in temp folders.
This batch script loaded “toy02.dat” as a loader, which decoded XOR-encrypted data from “toy01.dat”.
The process injected shellcode into memory, making it fileless and resistant to disk-based detection. A new thread spawned, executing code dynamically often testing with calc.exe before swapping in real payloads.
Attackers bound PowerShell via WinRAR SFX options, setting “Run after extraction” to fire on ZIP open.
This hid commands behind innocent images, mimicking posters or HWP letters to North Korean troops in Russia. No user interaction beyond extraction was needed, boosting success rates.
| Stage | Key Files/Techniques | Purpose |
|---|---|---|
| Delivery | Fake HWP link → Dropbox ZIP | Lure with geopolitical bait |
| LNK Trigger | toy03.bat, PowerShell args | Silent command launch |
| Loader | toy02.dat → toy01.dat (XOR decode) | Memory shellcode injection |
| Execution | Fileless threads | Dynamic malware runtime |
C2 Evasion and Data Theft
Acoording to Medium, the malware beaconed to dual C2 channels for persistence. Primary: Dropbox API, using a stolen access token to upload command outputs amid legit traffic.
Base64 encoding hid data; predefined IDs authenticated clients. Genians noted BearC2 influences in final payloads, downloaded via masked Dropbox URLs.
Shellcode slots fetched implants automatically with “start” commands, enabling remote control. Exfiltrated data included system info and outputs, aiding espionage on North Korea watchers.
Defenses hinge on behavioral tools. Block untrusted LNK/PowerShell in emails. Monitor Dropbox API anomalies, temp folder drops (toy*.dat/bat), and memory injections. Enable AMSI for script scanning. Hunt XOR loaders and SFX archives in archives.
GSC urges North Korea researchers to verify sources. This campaign shows Chollima’s evolution: LNKs for entry, cloud C2 for stealth, fileless for dwell. As tensions rise over DPRK-Russia ties, expect more such ops.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
