Loading threat actor…
Golden Chollima is a North Korea-linked threat actor assessed to operate as a distinct organizational unit within the DPRK cyber apparatus and as part of the broader Lazarus ecosystem. It emerged from the restructuring of activity historically associated with Labyrinth Chollima and remains closely coordinated with sibling clusters including Pressure Chollima and the espionage-focused core Labyrinth Chollima through shared tooling, infrastructure, and malware lineage rooted in the KorDLL and Hawup frameworks. Golden Chollima is primarily financially motivated and specializes in steady, smaller-scale cryptocurrency theft and baseline revenue generation for the North Korean regime. Its targeting centers on economically developed regions with mature cryptocurrency and fintech sectors, especially fintech firms and other organizations handling digital assets. Reported operations have targeted victims in the United States, Canada, South Korea, India, and Western Europe. The group is strongly associated with the Jeus and AppleJeus malware lineage, including campaigns in which trojanized cryptocurrency-related software was used to compromise victims and drain wallets. Additional malware and tooling linked to Golden Chollima include specialized fintech-targeting families with code overlap across PipeDown, DevobRAT, HTTPHelper, and Anycon, as well as later deployments of SnakeBaker and the JavaScript variant NodalBaker. Golden Chollima has also been observed using malicious Python packages and other software supply chain style delivery mechanisms, alongside recruitment-themed social engineering, trojanized legitimate software, and malicious Node.js or Python package ecosystems more broadly associated with related DPRK operations. Operationally, Golden Chollima has demonstrated the ability to obtain initial access through recruitment fraud and software package abuse, pivot into victim cloud environments, access IAM-related configurations and cloud resources, and ultimately divert cryptocurrency assets. The group has also been observed leveraging Chromium zero-days to deliver malware, indicating access to advanced exploitation capability. Reporting further indicates shared access to higher-end DPRK tooling, including FudModule, underscoring coordination with other North Korean clusters even where mission focus differs. Golden Chollima is best understood as a specialized DPRK revenue-generation actor focused on cryptocurrency and fintech theft rather than espionage as its primary mission. Its role appears to complement Pressure Chollima’s larger heists by maintaining a consistent stream of illicit revenue through repeated lower-value compromises.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korean cluster focused on repeated smaller-scale cryptocurrency theft operations in economically developed regions.
Financially motivated DPRK-linked subgroup focused on steady, smaller-value cryptocurrency theft, including wallet-draining operations against fintech/crypto targets; shares tooling with the broader Labyrinth Chollima ecosystem and has been observed using advanced components like FudModule.
North Korea-linked activity cluster focused on cryptocurrency theft to generate revenue for the regime and fund cyber operations.
Cryptocurrency/fintech theft-focused DPRK cluster emphasizing steady, smaller-scale thefts in economically advanced regions; uses trojanized crypto software lures, malicious Python packages (including via recruitment fraud), Chromium zero-days, and fintech-targeted malware families.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.