The campaign appears to be a continuation of Lazarus activity dubbed Operation Dream Job, which was first observed in August 2020. Symantec tracks this sub-set of Lazarus activity under the name Pompilus.

In February 2019, PRESSURE CHOLLIMA emerged as a distinct LABYRINTH CHOLLIMA operational subgroup; the adversary now represents one of the most technically advanced Democratic People’s Republic of Korea (DPRK)–nexus adversaries. PRESSURE CHOLLIMA specializes in high-risk, high-reward cryptocurrency theft operations, deploying highly sophisticated, low-prevalence malware such as SparkDownloader