Labyrinth Chollima

Labyrinth Chollima, a threat actor linked to North Korea, has been active since 2009 and is known for conducting operations aimed at collecting political, military, and economic intelligence on North Korea’s foreign adversaries, as well as currency generation campaigns. This group, also known by various other names including Hidden Cobra, BeagleBoyz, Lazarus Group, APT-C-26, Zinc, Black Artemis, and UNC4736, has targeted numerous industries worldwide, such as academia, energy, government, healthcare, media, retail, technology, aerospace, agriculture, cryptocurrency, defense, industrials and engineering, military, national government, opportunistic, pharmaceuticals, and art. Their activities have impacted countries globally including Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Norway, Estonia, Germany, Hungary, India, Ireland, Israel, Italy, Japan, Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Turkey, Ukraine, the United Kingdom, and the United States. In March 2023, Labyrinth Chollima was implicated in a supply chain attack against VoIP software maker 3CX, with follow-on attacks on 3CX customers concentrated in the cryptocurrency industry. The attribution of this attack to Labyrinth Chollima was based on similarities in the malicious code employed in the campaign. The group's actions have been tracked by several security companies under different names, including Temp.Hermit and Diamond Sleet. This intrusion was attributed to Labyrinth Chollima, a subunit of the notorious Lazarus Group, the North Korean government hacking unit known for stealthy hacks targeting cryptocurrency exchanges. The threat actor has also exploited vulnerabilities such as the Google Chrome zero-day CVE-2024-7971 to deploy the FudModule rootkit, according to Microsoft. It is one of the most prolific Democratic People’s Republic of Korea adversaries tracked by CrowdStrike. The group's activities overlap with those of other North Korean-linked groups such as Diamond Sleet, Temp.Hermit, and Citrine Sleet, indicating a possible collaboration or shared resources among these entities. Given the wide range of industries and countries targeted, it is clear that Labyrinth Chollima poses a significant global cybersecurity threat.