Long-running North Korea threat group splits into 3 distinct operations

Long-running North Korea threat group splits into 3 distinct operations

A North Korea-backed threat group operating since 2009 has splintered into three distinct groups with specialized malware and objectives, CrowdStrike said in a report released Thursday. Labeled “Labyrinth Chollima” by the company, the group follows a divergence pattern CrowdStrike observed previously. Labyrinth Chollima has spawned two additional groups: Golden Chollima and Pressure Chollima. The spin-offs, which have been operating since 2020, …

CrowdStrike splits LABYRINTH CHOLLIMA into three units

CrowdStrike has split North Korea-linked LABYRINTH CHOLLIMA into three units, two for crypto theft and one for industrial espionage.

LABYRINTH CHOLLIMA Evolves into Three Adversaries

GOLDEN CHOLLIMA GOLDEN CHOLLIMA targets economically developed regions with significant cryptocurrency and fintech presence, including the U.S., Canada, South Korea, India, and Western Europe. The adversary typically conducts smaller-value thefts at a more consistent operational tempo, suggesting responsibility for ensuring baseline revenue generation for the DPRK regime.  The adversary’s malware originates with Jeus in 2018 (and its macOS varia…