2024 Recap - North Korean Threat Actor Activity
Dec 13, 2024 2:20:52 PM / by The Hivemind posted in Threat Bulletin, North Korea, Asia, APAC, 2024, Recap
Silent Chollima Extortion Activity Targets US Entities
Oct 11, 2024 2:12:45 PM / by The Hivemind posted in Threat Bulletin, North Korea, Extortion, Silent Chollima, Andariel, APT 45, Stonefly, Onyx Sleet, Preft
Related Families: Preft
Labyrinth Chollima Using Poisoned Python Packages to Deliver PondRAT
Sep 30, 2024 1:49:09 PM / by The Hivemind posted in Threat Bulletin, North Korea, Linux, MacOS, PondRAT, PoolRAT, Labyrinth Chollima
Related Families: PondRAT, PoolRAT
Verticals Targeted: Software Development
Executive Summary
North Korea nexus threat actor group Labyrinth Chollima was observed using poisoned Python packages to deliver PondRAT, a backdoor that targets MacOS and Linux systems.
DevPopper Campaign Targets Software Developers
Aug 26, 2024 1:38:47 PM / by The Hivemind posted in Threat Bulletin, North Korea, RAT, DevPopper
Verticals Targeted: Software Development
Executive Summary
An ongoing social engineering campaign was observed targeting software developers. The threat actors use fake interviews to deliver a Python-based RAT, known as DevPopper.
Silent Chollima's Espionage Activity
Aug 2, 2024 2:15:57 PM / by The Hivemind posted in Threat Bulletin, Espionage, North Korea, Dtrack, Dora RAT, TigerRAT, Silent Chollima, SmallTiger
Related Families: Dtrack, Dora RAT, TigerRAT, SmallTiger, LightHand, ValidAlpha
Verticals Targeted: Military, Defense, Engineering, Technology, Education, Construction, Manufacturing, Gambling, Energy
Executive Summary
Last week, the US Department of Justice (DOJ) indicted Rim Jong Hyok, an individual allegedly affiliated with Silent Chollima. The group has been active since at least 2014 and is known to conduct espionage operations on behalf of North Korea.
New North Korean Threat Actor Group Moonstone Sleet
Jun 7, 2024 12:58:01 PM / by The Hivemind posted in Threat Bulletin, North Korea, MoonstoneSleet, YouieLoad, Threat Actor Profile, SplitLoader
Related Families: SplitLoader, YouieLoad
Verticals Targeted: Education, Software, Information Technology, Defense, Aerospace
Executive Summary
Moonstone Sleet is a newly identified North Korea nexus threat actor group. The group leverages a combination of commonly used North Korean threat actor TTPs, along with their own unique attack methodologies.
Velvet Chollima Using Gomir Linux Backdoor
May 24, 2024 11:58:05 AM / by The Hivemind posted in Threat Bulletin, Espionage, North Korea, Linux, Kimsuky, GoBear, Velvet Chollima, Gomir, Troll Stealer
Related Families: GoBear, Troll Stealer, BetaSeed, Endor
Verticals Targeted: Government
Executive Summary
North Korea nexus threat actor group Velvet Chollima was observed using a new Linux backdoor, dubbed Gomir, to target entities in South Korea.
2023 Recap - Threat Actor Activity Highlights - North Korea
Dec 15, 2023 1:37:07 PM / by The Hivemind posted in Threat Bulletin, North Korea, APAC, 2023 Recap, Chollima