Devobrat
DevobRAT is malware associated in the provided reporting with DPRK-linked GOLDEN CHOLLIMA activity, part of the broader Labyrinth Chollima ecosystem. The content does not provide a standalone technical profile for DevobRAT, but it explicitly states that GOLDEN CHOLLIMA variants exhibit shellcode overlaps between PipeDown, DevobRAT, HTTPHelper, and Anycon, indicating DevobRAT is part of a shared or related fintech-targeting malware toolkit. GOLDEN CHOLLIMA is described as a North Korea-linked cluster focused on cryptocurrency and fintech theft, targeting economically advanced regions including the United States, Canada, South Korea, India, and Western Europe. Related operations have used trojanized cryptocurrency software, recruitment fraud, malicious Python packages, cloud-environment pivots for IAM access, cryptocurrency diversion, and Chromium zero-days. Based on the provided content, DevobRAT is linked by code overlap to this toolkit and threat activity, but specific infection vectors, platform details, persistence mechanisms, or unique indicators of compromise for DevobRAT itself are not provided.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Subsequent variants exhibit shellcode overlaps with Pipedown, Devobrat, Httphelper, and Anycon.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used as part of a DPRK-linked fintech/crypto targeting toolkit; related to other implants via shellcode overlap.
Referenced as a related malware family showing shellcode overlap with later Jeus/AppleJeus variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.