Loading malware…
DevobRAT is a malware family associated with DPRK-linked cryptocurrency intrusion activity, particularly operations tracked as GOLDEN CHOLLIMA. It has been observed alongside Jeus and AppleJeus variants in campaigns targeting cryptocurrency businesses and fintech organizations. Available reporting places DevobRAT within a specialized fintech-targeting toolkit that also includes PipeDown, HTTPHelper, and Anycon, with noted shellcode overlap indicating shared development lineage or component reuse.
High-confidence public information on DevobRAT’s standalone functionality is limited. Its significance is primarily its association with financially motivated North Korean operations focused on digital-asset theft and intrusion into cryptocurrency-related environments. These campaigns have targeted organizations in economically developed regions with substantial cryptocurrency and fintech activity. The broader intrusion ecosystem around this tooling has included trojanized cryptocurrency-themed software, malicious Python packages, recruitment-themed social engineering, and exploitation of browser vulnerabilities, but those delivery mechanisms are not specifically attributable to DevobRAT itself at high confidence based on the available facts.
DevobRAT is best understood as one element of a coordinated malware set used in DPRK fintech operations rather than as a fully characterized standalone family with publicly documented behavior. Its observed overlap with related malware families suggests shared tooling and close operational coordination within North Korea’s cyber apparatus.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CrowdStrike Intelligence has observed eight different Jeus and AppleJeus variants in campaigns targeting cryptocurrency entities as well as shellcode overlaps between PipeDown, DevobRAT, HTTPHelper, and Anycon — forming a specialized fintech targeting toolkit.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A RAT/tool within a specialized fintech-targeting toolkit linked by shellcode overlaps in GOLDEN CHOLLIMA activity.
Referenced as a related malware family showing shellcode overlap with later Jeus/AppleJeus variants.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.