CrowdStrike reassesses LABYRINTH CHOLLIMA as having evolved into three specialized DPRK-nexus adversaries: GOLDEN CHOLLIMA, PRESSURE CHOLLIMA, and a narrower core LABYRINTH CHOLLIMA espionage group. GOLDEN CHOLLIMA focuses on sustained cryptocurrency and fintech theft using Jeus and AppleJeus lineage tooling, malicious Python packages, cloud pivots, and recent SnakeBaker or NodalBaker deployments. PRESSURE CHOLLIMA pursues high-value digital-asset theft with lower-prevalence implants such as SparkDownloader, Scuzzyfuss, and TwoPence Electric delivered through malicious Node.js and Python projects. Core LABYRINTH CHOLLIMA remains focused on espionage against defense, manufacturing, industrial, logistics, and shipping targets, using Hoplight-lineage malware, FudModule capabilities, zero-days, WhatsApp delivery, employment lures, and trojanized applications. Shared infrastructure, code, and tradecraft indicate coordination across distinct DPRK operational units serving both revenue generation and intelligence collection.