Labyrinth Chollima - DPRK Threat Actor | lazarus.day

Labyrinth Chollima

2018-02-26 • Crowd Strike • https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/

52

Related Actors
19

Related Reports

Related Actors

Lazarus

Novetta

First seen: Feb 2016

Last seen: Jun 2026

Appleworm

Symantec

Lazarus

First seen: Apr 2017

Last seen: Feb 2021

APT-C-26

Qihoo360

Lazarus

First seen: Aug 2016

Last seen: Jun 2026

Citrine Sleet

Microsoft

Apple Jeus

First seen: Dec 2022

Last seen: May 2026

UNC1720

Mandiant

Apple Jeus

First seen: Oct 2023

Last seen: Aug 2025

REF7001

Elastic

Lazarus

First seen: Nov 2023

Last seen: Oct 2024

Black Artemis

PWC

Lazarus

First seen: Mar 2020

Last seen: Apr 2023

Bureau121

Lazarus

First seen: Nov 2020

Last seen: Nov 2020

COVELLITE

Dragos

Black Artemis

First seen: May 2018

Last seen: May 2018

Moonstone Sleet

Microsoft

Lazarus

First seen: May 2024

Last seen: Nov 2025

DEV-0139

Microsoft

Lazarus

First seen: Dec 2022

Last seen: Dec 2022

Storm-1789

Microsoft

Moonstone Sleet

First seen: May 2024

Last seen: May 2024

G0032

MITRE

Lazarus

First seen: May 2017

Last seen: May 2017

Gods Apostles

Self Given

Lazarus

Gods Disciples

Self Given

Lazarus

Guardiansof Peace

Self Given

Lazarus

First seen: Dec 2014

Last seen: Dec 2014

Group77

Cisco Talos

Lazarus

First seen: Feb 2016

Last seen: Sep 2019

Hastati

Secure Works

Lazarus

First seen: Mar 2013

Last seen: Mar 2013

Hidden Cobra

USCISA

Lazarus

First seen: Jun 2017

Last seen: Mar 2021

New Romanic Cyber Army Team

Mcafee

Guardiansof Peace

First seen: Jul 2013

Last seen: Dec 2014

Greedyman

KRCERT

Lazarus

Stressed Pungsan

Datadog

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

Nickel Academy

Secure Works

Lazarus

First seen: Dec 2017

Last seen: Oct 2024

Office91

Lazarus

First seen: Sep 2019

Last seen: Sep 2019

TA404

Proofpoint

Lazarus

First seen: Jul 2022

Last seen: Jul 2022

Gleaming Pisces

Paloalto Networks

Apple Jeus

First seen: Sep 2024

Last seen: May 2026

Red Dot

Ahnlab

Labyrinth Chollima

First seen: Jul 2017

Last seen: Sep 2019

Sector A01

NSHC

Lazarus

First seen: Jan 2019

Last seen: Nov 2025

Void Imugi

Trend Micro

Lazarus

First seen: Jun 2024

Last seen: Mar 2025

Selective Pisces

Paloalto Networks

Lazarus

First seen: Sep 2022

Last seen: Sep 2024

Unit121

Lazarus

First seen: Nov 2020

Last seen: Nov 2020

WHOis Team

Mcafee

Lazarus

First seen: Mar 2013

Last seen: Dec 2014

Zinc

Microsoft

Lazarus

First seen: Dec 2017

Last seen: Nov 2022

G1036

MITRE

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

RGB-D3

Issuemakers Lab

Lazarus

First seen: May 2020

Last seen: Sep 2020

BABYLONGROUP

Chollima Group

Moonstone Sleet

First seen: Aug 2025

Last seen: Sep 2025

APT-Q-1

Qianxin

Lazarus

First seen: Mar 2023

Last seen: Aug 2025

Apple Jeus

Kaspersky

Lazarus

First seen: Aug 2018

Last seen: May 2026

G1049

MITRE

Apple Jeus

First seen: Aug 2025

Last seen: Aug 2025

CTG-2460

Secure Works

Nickel Academy

First seen: Sep 2020

Last seen: Sep 2020

Golden Chollima

Crowd Strike

Citrine Sleet

First seen: Jan 2026

Last seen: May 2026

Pompilus

Symantec

Diamond Sleet

First seen: Apr 2022

Last seen: Apr 2022

UAT-10027

Cisco Talos

Lazarus

First seen: Feb 2026

Last seen: Feb 2026

UTA0040

Volexity

UNC4736

First seen: Mar 2023

Last seen: Mar 2023

UNC4736

Mandiant

Apple Jeus

First seen: Apr 2023

Last seen: May 2026

Diamond Sleet

Microsoft

Zinc

First seen: Apr 2023

Last seen: Feb 2024

Storm-0139

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

Storm-1222

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

WASSONITE

Dragos

Lazarus

First seen: May 2020

Last seen: Feb 2023

ITG03

IBM

Lazarus

First seen: Nov 2021

Last seen: Nov 2021

ATK3

Thales Group

Hidden Cobra

First seen: Oct 2019

Last seen: May 2022

REF9134

Elastic

Lazarus

First seen: Jun 2023

Last seen: Jun 2023

Related Reports

Top Authors

View all reports in this cluster

2026-06-09

Crowd Strike

CrowdStrike 2026 Report: China Fuels Attacks on Tech

#FamousChollima #LabyrinthChollima #StardustChollima #Trend

2026-02-06

Poly Swarm

Labyrinth Chollima Expands Activity, Spawns Offshoots

#GoldenChollima #LabyrinthChollima #PressureChollima

2026-01-29

Crowd Strike

LABYRINTH CHOLLIMA Evolves into Three Adversaries

#GoldenChollima #LabyrinthChollima #PressureChollima

2025-02-27

Crowd Strike

2025 Global Threat Report

#FamousChollima #LabyrinthChollima #Trend

2025-02-16

S3N4T0R

Labyrinth Chollima APT Adversary Simulation

#LabyrinthChollima

2024-12-13

Poly Swarm

2024 Recap - North Korean Threat Actor Activity

#MoonstoneSleet #FamousChollima #LabyrinthChollima #RicochetChollima #SilentChollima #StardustChollima #VelvetChollima

2024-11-22

Vulncheck

Exploring CISA’s 2023 Top Routinely Exploited Vulnerabilities

#LabyrinthChollima #SilentChollima #Trend #VelvetChollima

2024-09-30

Poly Swarm

Labyrinth Chollima Using Poisoned Python Packages to Deliver PondRAT

#LabyrinthChollima #PondRAT #POOLRAT #PyPI

2024-04-03

Norfolk

North Korea’s Post-Infection Python Payloads

#LabyrinthChollima #NPM

2024-02-27

Fortinet

FortiGuard Labs Outbreak Alerts Annual Report 2023: A Glimpse into the Evolving Threat Landscape

#LabyrinthChollima #Trend #Andariel #DiamondSleet

2023-11-14

Birmingham Cyber

QRLog Malware Analysis

#LabyrinthChollima #QRLog

2023-10-13

Crowd Strike

Navigating the LABYRINTH: An In-Depth Examination of Interactive Intrusions by a North Korean APT

#LabyrinthChollima #macOS #AppleJeus

2023-08-31

Reversing Labs

VMConnect supply chain attack continues, evidence points to North Korea

#LabyrinthChollima #VMConnect #PyPI

2023-08-19

Birmingham Cyber

Riding with the Chollimas

#LabyrinthChollima #QRLog

2023-08-08

Crowd Strike

NOWHERE TO HIDE CROWDSTRIKE 2023 THREAT HUNTING REPORT

#LabyrinthChollima #Trend #T1190 #T1036 #T1016 #T1482 #T1056 #T1558 #T1556 #T1480 #T1552 #T1078 #T1020 #T1555 #T1556.008 #T1046 #T1547 #T1070 #T1110 #T1204 #T1059 #T1003

View all reports in this cluster