Loading malware…
SnakeBaker is malware associated with DPRK-linked GOLDEN CHOLLIMA activity. CrowdStrike OverWatch reported deployments of SnakeBaker, along with its JavaScript variant NodalBaker, at fintech firms in June 2025. The malware is described in the context of GOLDEN CHOLLIMA operations targeting economically advanced regions with significant cryptocurrency and fintech sectors, and its deployment was observed alongside additional tradecraft including exploitation of Chromium zero-days. Based on the provided content, SnakeBaker is part of GOLDEN CHOLLIMA’s fintech-focused intrusion toolkit used against fintech targets. No further technical capabilities, infection chain details, or specific indicators of compromise for SnakeBaker itself are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additional tradecraft includes exploitation of Chromium zero-days and deployment of Snakebaker and Nodalbaker at fintech targets.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Implant/backdoor deployed at fintech firms; includes a JavaScript variant (NodalBaker).
Malware deployed against fintech targets as part of Golden Chollima tradecraft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.