FamousChollima
Famous Chollima is a DPRK-linked threat actor/cluster referenced in the provided content. The reporting associates it with North Korean cyber activity across software supply-chain and social-engineering themed operations. Mentioned activity includes North Korean job advertisement operations using Google Docs; abuse of Cloudflare Workers and Cloudflare Pages infrastructure; npm-related activity; a supply-chain RAT case involving "MicrosoftSystem64" exfiltrating to Hugging Face; a DPRK npm package reported to steal wallet keys and install an SSH backdoor; and campaigns referenced as Contagious Interview, StegaBin Wave, and Contagious Trader. The content also links the cluster to reporting involving RATs and ClickFix. The actor is discussed alongside other CrowdStrike Chollima clusters including Labyrinth Chollima and Stardust Chollima. Based on the provided content, Famous Chollima is associated with DPRK/North Korea and with targeting themes involving developers, job seekers, and cryptocurrency/trading ecosystems.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- KP
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced in connection with North Korea-themed cyber threat intelligence concerning job adverts hosted on Google Docs.
Referenced as a named threat actor in connection with a CrowdStrike technology threat landscape report.
Referenced in connection with a supply chain RAT campaign involving MicrosoftSystem64 and exfiltration to HuggingFace.
Referenced in connection with North Korea's abuse of Cloudflare Workers and Pages.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.