---
title: Silent Chollima's Espionage Activity
description: Last week, the US DOJ indicted an individual allegedly affiliated with Silent Chollima. Microsoft recently reported on the group and its TTPs.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Silent Chollima's Espionage Activity](https://blog.polyswarm.io/silent-chollimas-espionage-activity)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Aug 2, 2024 6:15:57 PM

**Related Families:** Dtrack, Dora RAT, TigerRAT, SmallTiger, LightHand, ValidAlpha  
**Verticals Targeted:** Military, Defense, Engineering, Technology, Education, Construction, Manufacturing, Gambling, Energy

## **Executive Summary**

## Last week, the US Department of Justice (DOJ) indicted Rim Jong Hyok, an individual allegedly affiliated with Silent Chollima. The group has been active since at least 2014 and is known to conduct espionage operations on behalf of North Korea.

**Key Takeaways**

- Last week, the US DOJ indicted Rim Jong Hyok, an individual allegedly affiliated with Silent Chollima. 
- Silent Chollima is a North Korean threat actor group that is reportedly an offshoot of Lazarus Group.
- The group has been active since at least 2014 and is known to conduct espionage operations on behalf of North Korea.
- Silent Chollima has an extensive arsenal of custom tools and malware, regularly evolving its TTPs to adapt to changes in the threat landscape. 

**Who is Silent Chollima?**

### Last week, the US Department of Justice (DOJ) [indicted](https://www.justice.gov/opa/pr/north-korean-government-hacker-charged-involvement-ransomware-attacks-targeting-us-hospitals) Rim Jong Hyok, an individual allegedly affiliated with Silent Chollima. Microsoft then [published](https://www.microsoft.com/en-us/security/blog/2024/07/25/onyx-sleet-uses-array-of-malware-to-gather-intelligence-for-north-korea/) its findings regarding Silent Chollima’s espionage activity. 

Silent Chollima, also known as Stonefly, Andariel, Onyx Sleet, TDrop2, and DarkSeoul, is a North Korean threat actor group that is reportedly an offshoot of Lazarus Group. The group has been active since at least 2014 and is known to conduct espionage operations on behalf of North Korea. More recently, the group has also been observed conducting activities for financial gain. Verticals targeted by Silent Chollima include military, defense, engineering, technology, education, construction, manufacturing, gambling, and energy. Targets are primarily located in India, South Korea, and the US. 

For initial access, Silent Chollima is known to use spearphishing. However, they have more recently moved to exploiting N-day vulnerabilities as well. For example, in late 2023, the group was observed exploiting the TeamCity vulnerability CVE-2023-42793, allowing them to perform remote code execution and obtain administrative control of the server.  

Silent Chollima has an extensive arsenal of custom tools and malware, regularly evolving its TTPs to adapt to changes in the threat landscape and evade detection. These custom tools range from RATs to ransomware. Custom malware associated with Silent Chollima includes but is not limited to Dtrack, Dora RAT, TigerRAT, SmallTiger, LightHand, and ValidAlpha. These families are described in further detail below. The group is also known to use open source tools, including Sliver, RMM tools, SOCKS proxy tools, Ngrok, and masscan.

**Dtrack**

Dtrack RAT was used by the group from 2019 to early 2024. Its attack chain leveraged the Log4j 2 vulnerability CVE-2021-44228 for initial access.  

**DoraRAT**

In May 2024, Silent Chollima was observed using Dora RAT to target education, construction, and manufacturing entities in South Korea. Dora RAT is written in Go and supports reverse shell and uploading and downloading of files.

**TigerRAT**

TigerRAT was observed in the wild as early as 2020. The threat actors can use TigerRAT to steal data and issue commands from the C2. 

**SmallTiger**

SmallTiger was observed in February 2024 targeting defense and manufacturing entities in South Korea. It is a backdoor written in C++.

**LightHand**

LightHand is a custom, lightweight backdoor used for remote access. The threat actors can use LightHand to execute arbitrary commands, obtain system storage information, list directories, and create or delete files. 

**ValidAlpha**

ValidAlpha, also known as BlackRAT, is a custom backdoor written in Go. It has been in use since at least 2023. ValidAlpha’s capabilities include running an arbitrary file, listing directory contents, downloading files, screenshotting, and launching a shell to execute commands. Silent Chollima was observed using ValidAlpha to target energy, defense, and engineering vertical entities. 

**IOCs**

PolySwarm has multiple samples associated with Silent Chollima activity.

 

[f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c](https://polyswarm.network/scan/results/file/f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c)

[0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207](https://polyswarm.network/scan/results/file/0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207)

[29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3](https://polyswarm.network/scan/results/file/29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3)

[fed94f461145681dc9347b382497a72542424c64b6ae6fcf945f4becd2d46c32](https://polyswarm.network/scan/results/file/fed94f461145681dc9347b382497a72542424c64b6ae6fcf945f4becd2d46c32)

[868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf](https://polyswarm.network/scan/results/file/868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf)

[f1662bee722a4e25614ed30933b0ced17b752d99fae868fbb326a46afa2282d5](https://polyswarm.network/scan/results/file/f1662bee722a4e25614ed30933b0ced17b752d99fae868fbb326a46afa2282d5)

[1b88b939e5ec186b2d19aec8f17792d493d74dd6ab3d5a6ddc42bfe78b01aff1](https://polyswarm.network/scan/results/file/1b88b939e5ec186b2d19aec8f17792d493d74dd6ab3d5a6ddc42bfe78b01aff1)

[3098e6e7ae23b3b8637677da7bfc0ba720e557e6df71fa54a8ef1579b6746061](https://polyswarm.network/scan/results/file/3098e6e7ae23b3b8637677da7bfc0ba720e557e6df71fa54a8ef1579b6746061)

[8daa6b20caf4bf384cc7912a73f243ce6e2f07a5cb3b3e95303db931c3fe339f](https://polyswarm.network/scan/results/file/8daa6b20caf4bf384cc7912a73f243ce6e2f07a5cb3b3e95303db931c3fe339f)

[7339cfa5a67f5a4261c18839ef971d7f96eaf60a46190cab590b439c71c4742b](https://polyswarm.network/scan/results/file/7339cfa5a67f5a4261c18839ef971d7f96eaf60a46190cab590b439c71c4742b)

 

You can use the following CLI command to search for all Silent Chollima samples in our portal:

**$ polyswarm link list -t SilentChollima**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) *|* [Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/silent-chollimas-espionage-activity)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2024-08-02T18:34:42.350Z",
  "datePublished" : "2024-08-02T18:15:57Z",
  "headline" : "Silent Chollima's Espionage Activity",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/SILENTCHOLLIMA.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/silent-chollimas-espionage-activity",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```