Golden Chollima

GOLDEN CHOLLIMA is a North Korea-linked threat actor assessed to operate as a distinct organizational unit within the DPRK cyber apparatus and to have emerged from the broader LABYRINTH CHOLLIMA cluster around 2018–2020. CrowdStrike describes it as one of the LABYRINTH CHOLLIMA spin-off groups focused on cryptocurrency theft, while the core LABYRINTH CHOLLIMA group shifted toward espionage. The group is described as conducting steady, smaller-value cryptocurrency thefts for baseline revenue generation, targeting economically developed regions with strong cryptocurrency and fintech sectors, including the United States, Canada, South Korea, India, and Western Europe. Reported targets include fintech firms in the U.S., South Korea, and Europe. Its malware lineage includes Jeus and the macOS variant AppleJeus, originally masquerading as cryptocurrency software from the fictitious company Celas Limited. CrowdStrike observed multiple Jeus and AppleJeus variants used against cryptocurrency entities. GOLDEN CHOLLIMA is also described as using malicious Python packages delivered through recruitment fraud to gain access to victim environments, including cloud environments where it manipulated IAM-related resources and diverted cryptocurrency to adversary-controlled wallets. Additional tooling and malware associated with the group in the provided content include SnakeBaker and the JavaScript variant NodalBaker. The content also states that GOLDEN CHOLLIMA has exploited Chromium zero-days and that some variants show shellcode overlaps with PipeDown, DevobRAT, HTTPHelper, and Anycon. The group shares tools, infrastructure, and tradecraft with LABYRINTH CHOLLIMA and PRESSURE CHOLLIMA, indicating centralized coordination within the DPRK ecosystem. Shared tradecraft mentioned in the content includes supply chain compromise, HR- or employment-themed social engineering, trojanized legitimate software, and malicious Node.js and Python packages. The content also notes that GOLDEN CHOLLIMA has reportedly used FudModule, further indicating tool sharing across related DPRK clusters. Known related groups and aliases directly mentioned in the content are LABYRINTH CHOLLIMA and PRESSURE CHOLLIMA as associated clusters spawned from the broader LABYRINTH CHOLLIMA activity.