Loading threat actor…
Pressure Chollima is a North Korean state-linked threat actor focused on high-value cryptocurrency theft. It is assessed to be one of several specialized operational clusters that emerged from the broader Labyrinth Chollima lineage within the DPRK cyber apparatus, alongside Golden Chollima and the core espionage-focused Labyrinth Chollima unit. The group is widely associated with large-scale, high-profile cryptocurrency heists, including record-setting thefts from organizations with substantial digital asset holdings, particularly centralized exchanges. Its operations are financially motivated and are assessed to support the North Korean regime. Pressure Chollima is regarded as one of the DPRK’s most technically advanced financially motivated intrusion groups. Its activity is characterized by highly targeted intrusions against high-payout opportunities regardless of geography. Reported tradecraft includes the use of malicious Node.js and Python projects, trojanized software, supply-chain style delivery mechanisms, and HR- or recruitment-themed social engineering to gain initial access. Malware and implant families associated with the group include SparkDownloader, Scuzzyfuss, and TwoPence Electric; SparkDownloader is publicly tracked by some vendors under the TraderTraitor designation. Reporting also links the actor to the Jade Sleet naming ecosystem. The group shares infrastructure, tooling lineage, and tradecraft with other DPRK clusters, with common roots traced to the KorDLL and Hawup frameworks, indicating centralized coordination despite mission specialization. Compared with the espionage-oriented Labyrinth Chollima cluster, Pressure Chollima is distinguished by its concentration on major cryptocurrency theft rather than intelligence collection. Its campaigns reflect a mature capability set spanning tailored initial compromise, malware delivery, post-compromise operations, and theft of digital assets at scale.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DPRK-aligned threat actor conducting sophisticated, targeted intrusions into large cryptocurrency exchanges.
North Korean cluster conducting high-value cryptocurrency heists using advanced implants against organizations with substantial digital asset holdings.
Technically advanced DPRK-linked subgroup focused on high-value cryptocurrency theft, including large-scale heists against centralized exchanges using sophisticated implants; part of the restructured Labyrinth Chollima ecosystem with shared resources.
North Korea-linked activity cluster focused on high-value cryptocurrency theft; described as highly technically advanced and responsible for a major ($1.46B) crypto heist.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.