Loading malware…
Anycon is a malware component associated with DPRK-linked cryptocurrency intrusion activity, particularly the GOLDEN CHOLLIMA cluster. It has been observed alongside Jeus and AppleJeus variants in campaigns targeting cryptocurrency and fintech organizations, and it is part of a specialized toolkit that also includes PipeDown, DevobRAT, and HTTPHelper. Reported shellcode overlaps among these families indicate shared development lineage or code reuse within a coordinated malware ecosystem.
The malware is linked to financially motivated operations focused on digital-asset theft. In this operational context, associated campaigns have used trojanized cryptocurrency-themed software, recruitment-themed social engineering, malicious Python packages, and exploitation of browser vulnerabilities to gain access to victim environments. The broader intrusion set has included post-compromise movement into cloud resources, manipulation of identity and access management configurations, and theft of cryptocurrency from targeted organizations.
Anycon is best understood as one element of a DPRK fintech-targeting malware arsenal rather than a broadly distributed standalone family. Its known use is tied to campaigns against cryptocurrency businesses and fintech entities, especially in economically developed regions with significant digital-asset activity. Publicly available information in this context does not support a more precise characterization of its standalone functionality beyond its role within this financially motivated intrusion toolkit.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CrowdStrike Intelligence has observed eight different Jeus and AppleJeus variants in campaigns targeting cryptocurrency entities as well as shellcode overlaps between PipeDown, DevobRAT, HTTPHelper, and Anycon — forming a specialized fintech targeting toolkit.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware/tool component in a specialized fintech-targeting toolkit associated with GOLDEN CHOLLIMA through shellcode overlaps.
Referenced as a related malware family showing shellcode overlap with later Jeus/AppleJeus variants.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.