Famous Chollima deploying Python version of GolangGhost RAT
Contents
- In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) we call “PylangGhost,” used exclusively by a North Korean-aligned threat actor. PylangGhost is functionally similar to the previously documented GolangGhost RAT, sharing many of the same capabilities.
- In recent campaigns, the threat actor Famous Chollima — potentially made up of multiple groups — has been using a Python-based version of their trojan to target Windows systems, while continuing to deploy a Golang-based version for MacOS users. Linux users are not targeted in these latest campaigns.
- The attacks are targeting employees with experience in cryptocurrency and blockchain technologies.
- Based on open-source intelligence, only a small number of users, predominantly in India, are affected. Cisco product telemetry does not indicate that there are any affected Cisco users.
Since mid-2024, the threat actor group Famous Chollima (aka Wagemole), a North Korean-aligned threat actor, has been very active through several well-documented campaigns. …
- In recent campaigns, the threat actor Famous Chollima — potentially made up of multiple groups — has been using a Python-based version of their trojan to target Windows systems, while continuing to deploy a Golang-based version for MacOS users. Linux users are not targeted in these latest campaigns.
- The attacks are targeting employees with experience in cryptocurrency and blockchain technologies.
- Based on open-source intelligence, only a small number of users, predominantly in India, are affected. Cisco product telemetry does not indicate that there are any affected Cisco users.
Since mid-2024, the threat actor group Famous Chollima (aka Wagemole), a North Korean-aligned threat actor, has been very active through several well-documented campaigns. …
IoC
http://api.nvidia-release.org
http://krakenhire.com
http://parallel.eskillora.com
http://api.quickdriverupdate.online
http://api.web-cam.cloud
http://api.camtuneup.online
http://api.drive-release.cloud
http://skill.vidintermaster.com
http://api.camdriversupport.com
http://api.quickcamfix.online
http://hxxp://154.58.204.15:8080
http://api.fixdiskpro.online
http://yuga.skillquestions.com
http://crosstheages.skillence360.com
http://evalassesso.com
http://api.auto-fixer.online
http://api.drivercams.cloud
http://hxxp://212.81.47.217:8080
http://www.smartvideohire.com
http://parallel.eskillprov.com
http://uniswap.speakure.com
http://coinbase.talentmonitoringtool.com
http://api.camtechdrivers.com
http://kraken.livehiringpro.com
http://assesstrack.com
http://api.autodriverfix.online
http://robinhood.ecareerscan.com
http://quantumnodespro.com
http://hxxp://31.57.243.29:8080
http://livetalentpro.com
http://digitaltalent.review
http://uniswap.testforhire.com
http://talent-hiringtalk.com
http://api.autocamfixer.online
http://uniswap.prehireiq.com
http://quiz-nest.com
http://api.nvidia-drive.cloud
http://api.camera-drive.org
http://doodles.skillquestions.com
http://api.driversofthub.online
http://api.vcamfixer.online
http://31.57.243.190:8080
http://api.nvidia-release.us
http://provevidskillcheck.com
http://evalswift.com
http://fast-video-recording.com
http://www.hireviavideo.com
http://coinbase.talenthiringtool.com
http://api.smartdriverfix.cloud
http://www.talent-hiringstep.com
212.81.47.217
154.58.204.15
31.57.243.29
31.57.243.190
b8402db19371db55eebea08cf1c1af984c3786d03ff7eae954de98a5c1186cee
8ead05bb10e6ab0627fcb3dd5baa59cdaab79aa3522a38dad0b7f1bc0dada10a
c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b
e7c2b524f5cb0761a973accc9a4163294d678f5ce6aca73a94d4e106f4c8fea4
0d14960395a9d396d413c2160570116e835f8b3200033a0e4e150f5e50b68bec
d3500266325555c9e777a4c585afc05dfd73b4cbe9dba741c5876593b78059fd
a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a
fb5362c4540a3cbff8cb1c678c00cc39801dc38151edc4a953e66ade3e069225
ed170975e3fd03440360628f447110e016f176a44f951fcf6bc8cdb47fbd8e0e
7ac3ffb78ae1d2d9b5d3d336d2a2409bd8f2f15f5fb371a1337dd487bd471e32
fc71a1df2bb4ac2a1cc3f306c3bdf0d754b9fab6d1ac78e4eceba5c6e7aee85d
267009d555f59e9bf5d82be8a046427f04a16d15c63d9c7ecca749b11d8c8fc3
929c69827cd2b03e7b03f9a53c08268ab37c29ac4bd1b23425f66a62ad74a13b
c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6
d029be4142fca334af8fe0f5f467a0e0e1c89d3b881833ee53c1e804dc912cfd
0ec9d355f482a292990055a9074fdabdb75d72630b920a61bdf387f2826f5385
5273d68b3aef1f5ebf420b91d66a064e34c4d3495332fd492fecb7ef4b19624e
127406b838228c39b368faa9d6903e7e712105b5ad8f43a987a99f7b10c29780
28198494f0ed5033085615a57573e3d748af19e4bd6ea215893ebeacf6e576df
1f482ce7e736a8541cc16e3e80c7890d13fb1f561ae38215a98a75dce1333cee
b7ab674c5ce421d9233577806343fc95602ba5385aa4624b42ebd3af6e97d3e5
http://krakenhire.com
http://parallel.eskillora.com
http://api.quickdriverupdate.online
http://api.web-cam.cloud
http://api.camtuneup.online
http://api.drive-release.cloud
http://skill.vidintermaster.com
http://api.camdriversupport.com
http://api.quickcamfix.online
http://hxxp://154.58.204.15:8080
http://api.fixdiskpro.online
http://yuga.skillquestions.com
http://crosstheages.skillence360.com
http://evalassesso.com
http://api.auto-fixer.online
http://api.drivercams.cloud
http://hxxp://212.81.47.217:8080
http://www.smartvideohire.com
http://parallel.eskillprov.com
http://uniswap.speakure.com
http://coinbase.talentmonitoringtool.com
http://api.camtechdrivers.com
http://kraken.livehiringpro.com
http://assesstrack.com
http://api.autodriverfix.online
http://robinhood.ecareerscan.com
http://quantumnodespro.com
http://hxxp://31.57.243.29:8080
http://livetalentpro.com
http://digitaltalent.review
http://uniswap.testforhire.com
http://talent-hiringtalk.com
http://api.autocamfixer.online
http://uniswap.prehireiq.com
http://quiz-nest.com
http://api.nvidia-drive.cloud
http://api.camera-drive.org
http://doodles.skillquestions.com
http://api.driversofthub.online
http://api.vcamfixer.online
http://31.57.243.190:8080
http://api.nvidia-release.us
http://provevidskillcheck.com
http://evalswift.com
http://fast-video-recording.com
http://www.hireviavideo.com
http://coinbase.talenthiringtool.com
http://api.smartdriverfix.cloud
http://www.talent-hiringstep.com
212.81.47.217
154.58.204.15
31.57.243.29
31.57.243.190
b8402db19371db55eebea08cf1c1af984c3786d03ff7eae954de98a5c1186cee
8ead05bb10e6ab0627fcb3dd5baa59cdaab79aa3522a38dad0b7f1bc0dada10a
c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b
e7c2b524f5cb0761a973accc9a4163294d678f5ce6aca73a94d4e106f4c8fea4
0d14960395a9d396d413c2160570116e835f8b3200033a0e4e150f5e50b68bec
d3500266325555c9e777a4c585afc05dfd73b4cbe9dba741c5876593b78059fd
a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a
fb5362c4540a3cbff8cb1c678c00cc39801dc38151edc4a953e66ade3e069225
ed170975e3fd03440360628f447110e016f176a44f951fcf6bc8cdb47fbd8e0e
7ac3ffb78ae1d2d9b5d3d336d2a2409bd8f2f15f5fb371a1337dd487bd471e32
fc71a1df2bb4ac2a1cc3f306c3bdf0d754b9fab6d1ac78e4eceba5c6e7aee85d
267009d555f59e9bf5d82be8a046427f04a16d15c63d9c7ecca749b11d8c8fc3
929c69827cd2b03e7b03f9a53c08268ab37c29ac4bd1b23425f66a62ad74a13b
c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6
d029be4142fca334af8fe0f5f467a0e0e1c89d3b881833ee53c1e804dc912cfd
0ec9d355f482a292990055a9074fdabdb75d72630b920a61bdf387f2826f5385
5273d68b3aef1f5ebf420b91d66a064e34c4d3495332fd492fecb7ef4b19624e
127406b838228c39b368faa9d6903e7e712105b5ad8f43a987a99f7b10c29780
28198494f0ed5033085615a57573e3d748af19e4bd6ea215893ebeacf6e576df
1f482ce7e736a8541cc16e3e80c7890d13fb1f561ae38215a98a75dce1333cee
b7ab674c5ce421d9233577806343fc95602ba5385aa4624b42ebd3af6e97d3e5