lazarusholic

Everyday is lazarus.dayβ

LabyrinthChollima

2018-02-26, CrowdStrike
https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/
"LABYRINTH CHOLLIMA is one of the most prolific Democratic People’s Republic of Korea (DPRK) adversaries tracked by CrowdStrike and has been active at least since 2009. CrowdStrike assesses this adversary is likely affiliated with Bureau 121 of the DPRK’s Reconnaissance General Bureau (RGB) and primarily conducts espionage operations aimed at the U.S. and Republic of Korea (RoK) militaries and defe..."

- CrowdStrike, https://www.crowdstrike.com/adversaries/labyrinth-chollima/

Also known as

 
Name Named by AKA First seen Last seen
APT-C-26 Qihoo360 Lazarus 2018-08-15 2026-06-03
APT-Q-1 Qianxin Lazarus 2023-03-14 2025-08-28
Appleworm Symantec Lazarus 2017-04-01 2021-02-18
BlackArtemis PWC Lazarus 2020-03-03 2023-04-12
Bureau121 - Lazarus - 2020-11-23
CitrineSleet Microsoft Lazarus 2023-10-06 2025-03-27
DEV-0139 Microsoft Lazarus 2022-12-06 2022-12-06
G0032 MITRE Lazarus 2017-05-31 2017-05-31
GodsApostles SelfGiven Lazarus 2014-11-24 -
GodsDisciples SelfGiven Lazarus 2014-11-24 -
Greedyman KRCERT Lazarus 2020-02-29 -
Group77 CiscoTalos Lazarus 2016-02-24 2019-09-13
GuardiansofPeace SelfGiven Lazarus 2014-11-24 2014-12-05
Hastati SecureWorks Lazarus - 2013-03-21
HiddenCobra USCISA Lazarus 2017-06-13 2021-03-25
ITG03 IBM Lazarus - -
LabyrinthChollima CrowdStrike Lazarus 2018-02-26 2026-06-09
Lazarus Novetta - 2016-02-24 2026-06-03
MoonstoneSleet Microsoft Lazarus 2024-05-28 2025-11-24
NickelAcademy SecureWorks Lazarus - 2024-10-08
Office91 - Lazarus - 2019-09-13
REF7001 Elastic Lazarus 2023-11-01 2024-10-03
REF9134 Elastic Lazarus 2023-06-21 2023-06-21
RGB-D3 IssuemakersLab Lazarus 2020-05-20 2020-09-08
RedDot Ahnlab LabyrinthChollima 2017-07-03 2019-09-13
SectorA01 NSHC Lazarus 2019-01-23 2025-11-25
SelectivePisces PaloaltoNetworks Lazarus 2022-09-26 2024-09-09
TA404 Proofpoint Lazarus 2022-07-14 2022-07-14
UAT-10027 CiscoTalos Lazarus 2026-02-26 2026-02-26
Unit121 - Lazarus - 2020-11-23
VoidImugi TrendMicro Lazarus 2024-06-10 2025-03-18
WASSONITE Dragos Lazarus 2020-05-30 2023-02-14
WHOisTeam Mcafee Lazarus 2013-03-20 2014-12-23
Zinc Microsoft Lazarus 2017-12-19 2022-11-22

Reports

2026-06-09
CrowdStrike
CrowdStrike 2026 Report: China Fuels Attacks on Tech
#FamousChollima #LabyrinthChollima #StardustChollima #Trend
2026-02-06
PolySwarm
Labyrinth Chollima Expands Activity, Spawns Offshoots
#GoldenChollima #LabyrinthChollima #PressureChollima
2026-01-29
CrowdStrike
LABYRINTH CHOLLIMA Evolves into Three Adversaries
#GoldenChollima #LabyrinthChollima #PressureChollima
2025-02-27
CrowdStrike
2025 Global Threat Report
#FamousChollima #LabyrinthChollima #Trend
2025-02-16
S3N4T0R
Labyrinth Chollima APT Adversary Simulation
#LabyrinthChollima
2024-12-13
PolySwarm
2024 Recap - North Korean Threat Actor Activity
#MoonstoneSleet #FamousChollima #LabyrinthChollima #RicochetChollima #SilentChollima #StardustChollima #VelvetChollima
2024-11-22
Vulncheck
Exploring CISA’s 2023 Top Routinely Exploited Vulnerabilities
#LabyrinthChollima #SilentChollima #Trend #VelvetChollima
2024-09-30
PolySwarm
Labyrinth Chollima Using Poisoned Python Packages to Deliver PondRAT
#LabyrinthChollima #PondRAT #POOLRAT #PyPI
2024-04-03
Norfolk
North Korea’s Post-Infection Python Payloads
#LabyrinthChollima #NPM
2024-02-27
Fortinet
FortiGuard Labs Outbreak Alerts Annual Report 2023: A Glimpse into the Evolving Threat Landscape
#LabyrinthChollima #Trend #Andariel #DiamondSleet
2023-11-14
BirminghamCyber
QRLog Malware Analysis
#LabyrinthChollima #QRLog
2023-10-13
CrowdStrike
Navigating the LABYRINTH: An In-Depth Examination of Interactive Intrusions by a North Korean APT
#LabyrinthChollima #macOS #AppleJeus
2023-08-31
ReversingLabs
VMConnect supply chain attack continues, evidence points to North Korea
#LabyrinthChollima #VMConnect #PyPI
2023-08-19
BirminghamCyber
Riding with the Chollimas
#LabyrinthChollima #QRLog
2023-08-08
CrowdStrike
NOWHERE TO HIDE CROWDSTRIKE 2023 THREAT HUNTING REPORT
#LabyrinthChollima #Trend
2023-03-29
CrowdStrike
CrowdStrike Prevents 3CXDesktopApp Intrusion Campaign
#LabyrinthChollima #3CXDesktopApp #SupplyChain #SmoothOperator
2019-02-19
CrowdStrike
2019 Global Threat Report
#VelvetChollima #Trend #StardustChollima #LabyrinthChollima #SilentChollima #RicochetChollima
2018-02-26
CrowdStrike
2018 CrowdStrike Global Threat Report
#Trend #Chollima #LabyrinthChollima #SilentChollima #StardustChollima