Active since at least 2018, GOLDEN CHOLLIMA emerged from the historical LABYRINTH CHOLLIMA group, likely as the result of organizational restructuring to focus on currency generation. The adversary primarily focuses on cryptocurrency theft operations targeting the global financial technology (fintech) sector, employing malware disguised as legitimate cryptocurrency trading applications.