CrowdStrike Identifies Three Splinter Groups from LABYRINTH CHOLLIMA

Securitybrief.Au

CrowdStrike Identifies Three Splinter Groups from LABYRINTH CHOLLIMA

First seen 30 Jan 2026, 05:02 UTC • •25.0

Article Content

1 / 7

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

CrowdStrike has reclassified the North Korea-linked intrusion set LABYRINTH CHOLLIMA into three distinct units: GOLDEN CHOLLIMA and PRESSURE CHOLLIMA, which focus on cryptocurrency theft, and the core LABYRINTH CHOLLIMA unit, which is dedicated to espionage against industrial and defense-related organizations. This assessment reflects a strategic shift in the group's operations, allowing for specialized malware and objectives.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 237d ago How this analysis works

More articles in this cluster (6)

Threat Graph

15 entities, 54 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (9)

Diamond Sleet
Golden Chollima
Labyrinth Chollima
Lazarus Group
Operation Dream Job
Pressure Chollima
Temp.Hermit
UNC4034
WannaCry

Technique (1)

Malware

Malware (5)

Brambul
Dozer
Joanap
KorDLL Bot
Koredos

Relationships

Diamond Sleet uses Brambul
Diamond Sleet uses Dozer
Diamond Sleet uses Joanap
Diamond Sleet uses KorDLL Bot
Diamond Sleet uses Koredos
Golden Chollima uses Brambul
Golden Chollima uses Dozer
Golden Chollima uses Joanap
Golden Chollima uses KorDLL Bot
Golden Chollima uses Koredos
Labyrinth Chollima uses Brambul
Labyrinth Chollima uses Dozer
Labyrinth Chollima uses Joanap
Labyrinth Chollima uses KorDLL Bot
Labyrinth Chollima uses Koredos
Lazarus Group uses Brambul
Lazarus Group uses Dozer
Lazarus Group uses Joanap
Lazarus Group uses KorDLL Bot
Lazarus Group uses Koredos
Operation Dream Job uses Brambul
Operation Dream Job uses Dozer
Operation Dream Job uses Joanap
Operation Dream Job uses KorDLL Bot
Operation Dream Job uses Koredos
Pressure Chollima uses Brambul
Pressure Chollima uses Dozer
Pressure Chollima uses Joanap
Pressure Chollima uses KorDLL Bot
Pressure Chollima uses Koredos
Temp.Hermit uses Brambul
Temp.Hermit uses Dozer
Temp.Hermit uses Joanap
Temp.Hermit uses KorDLL Bot
Temp.Hermit uses Koredos
UNC4034 uses Brambul
UNC4034 uses Dozer
UNC4034 uses Joanap
UNC4034 uses KorDLL Bot
UNC4034 uses Koredos
WannaCry uses Brambul
WannaCry uses Dozer
WannaCry uses Joanap
WannaCry uses KorDLL Bot
WannaCry uses Koredos
Diamond Sleet uses Malware
Golden Chollima uses Malware
Labyrinth Chollima uses Malware
Lazarus Group uses Malware
Operation Dream Job uses Malware
Pressure Chollima uses Malware
Temp.Hermit uses Malware
UNC4034 uses Malware
WannaCry uses Malware

Following this threat?

Track WannaCry, Diamond Sleet and Brambul in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in digital assets. The attackers exploited vulnerabilities in Binance's hot wallet system, allowing…

Binance Hack: $6.3 Billion Stolen by North Korean Group On October 30, 2026, hackers stole $6.3 billion in tokens from Binance, the world's largest crypto exchange. The attack is attributed to a North Korean hacking group known as TraderTraitor. The hackers executed the theft by quickly moving tokens, with the entire amount withdrawn within half an hour. Binance has…