Silent Chollima

Silent Chollima, also known as Stonefly or APT45, is a threat actor with links to North Korea's foreign intelligence agency, the 3rd Bureau of the Foreign Intelligence and Reconnaissance General Bureau. The group has been active since at least 2015, when it began shifting its objectives. Silent Chollima is associated with various cyber-espionage and destructive operations, including those attributed to sub-groups within the Lazarus umbrella such as Andariel (aka Onyx Sleet) and Diamond Sleet (aka Labyrinth Chollima). The group's mission appears to have evolved over time, with early operations demonstrating both destructive and espionage components. The threat actor has predominantly targeted Japan due to its proximity to North Korea and the geopolitical tensions in the region. Japanese organizations are seen as opportune targets for Silent Chollima to carry out their objectives. Furthermore, the group has been implicated in financially motivated cyberattacks against U.S. organizations, continuing these activities despite recent indictments from the U.S. Department of Justice. Recently, Silent Chollima has been associated with the exploitation of the CVE-2023-42793 vulnerability, which has a CVSS score of 9.8. This indicates a definitive shift in the group's tactics, suggesting that they are adapting and evolving their methods to achieve their goals. It remains unclear whether the TwoPence framework is used exclusively by related DPRK adversaries like Stardust Chollima, or if elements of it are shared among other related groups such as Labyrinth Chollima, Ricochet Chollima, or Silent Chollima.