Back Nknews

High-profile North Korean hacker group split into three distinct units: Report

Nknews • January 30, 2026

Researchers say subgroups of Labyrinth Chollima pursue crypto and espionage groups under unified strategy

Shreyas Reddy January 30, 2026

A high-profile North Korean cybercrime group previously believed to be one entity is actually operating as three “distinct, highly specialized” units with separate objectives, according to a U.S. cybersecurity firm.

Labyrinth Chollima, often associated with the Lazarus Group umbrella network, now comprises a core group that shares its name with the original entity and two other subgroups that researchers have dubbed Golden Chollima and Pressure Chollima, CrowdStrike said in a report released Thursday.

Since 2018, Golden Chollima and Pressure Chollima have dedicated themselves to stealing virtual currency, while the newer Labyrinth Chollima has primarily focused

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CrowdStrike Identifies Three Splinter Groups from LABYRINTH CHOLLIMA CrowdStrike has reclassified the North Korea-linked intrusion set LABYRINTH CHOLLIMA into three distinct units: GOLDEN CHOLLIMA and PRESSURE CHOLLIMA, which focus on cryptocurrency theft, and the core LABYRINTH CHOLLIMA unit, which is dedicated to espionage against industrial and defense-related organizations. This assessment reflects a strategic shift in the group's operations, allowing for specialized malware and objectives. 6 sources 25

Extracted Entities

APT Groups (4)

Golden Chollima Labyrinth Chollima Lazarus Group Pressure Chollima