Article

The Chollima advanced persistent threat group has initiated a targeted cyber-espionage campaign using malicious Windows shortcut files (LNK) to deliver multi-stage malware aimed at activists and analysts monitoring North Korea. By embedding weaponized LNK files in compressed attachments or cloud-hosted links, the campaign effectively bypassed security filters, enabling the theft of sensitive information and system reconnaissance. Security firms noted the campaign's evolution in tactics, reflecting similarities to previous Chollima operations.