Loading malware…
SwDownloader is a DPRK-linked malware family associated with the early evolution of PRESSURE CHOLLIMA from LABYRINTH CHOLLIMA. It appears to have been an experimental implant or delivery component used around early 2019 during the period when North Korean cyber operations were diverging into more specialized units focused on cryptocurrency theft and espionage. SwDownloader was reportedly short-lived and was quickly superseded by SparkDownloader, which is more widely tracked as TraderTraitor.
Available reporting supports only limited characterization of SwDownloader itself. Its significance lies primarily in its role as an early marker of PRESSURE CHOLLIMA’s operational separation and malware development trajectory. PRESSURE CHOLLIMA is associated with technically advanced, high-impact cryptocurrency theft operations targeting organizations with substantial digital-asset holdings, and SwDownloader sits at the beginning of that lineage. The broader ecosystem around this actor includes malicious software delivery through trojanized software and malicious development projects, but those delivery patterns are better established for successor tooling than for SwDownloader specifically.
SwDownloader is therefore best understood as an early DPRK-linked downloader-stage malware family tied to the emergence of PRESSURE CHOLLIMA’s cryptocurrency-focused operations, rather than as a broadly documented standalone platform with extensively published functionality.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PRESSURE CHOLLIMA operations likely diverged from LABYRINTH CHOLLIMA in February 2019 with experimental SwDownloader deployment, quickly replaced by SparkDownloader (tracked publicly as TraderTraitor).
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An experimental downloader used during the early divergence of PRESSURE CHOLLIMA operations in February 2019.
A downloader/loader used by Pressure Chollima, described as an early divergence point in 2019 and predecessor to Sparkdownloader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.