Silent Chollima

Silent Chollima, a North Korea-nexus threat actor, is known for its malicious cyber activities. The group, which is part of the 3rd Bureau of the Foreign Intelligence and Reconnaissance General Bureau, North Korea's foreign intelligence agency, has been associated with other groups such as Lazarus, APT38, and Andariel. Silent Chollima, also known as Andariel or Stonefly, began shifting their objectives in 2015. Prior to this shift, their operations demonstrated both destructive and espionage components. There was also an attempt at revenue generation by Silent Chollima, identified by CrowdStrike, before tracking Stardust Chollima, another North Korea-nexus threat actor. Japanese organizations have been targeted due to the proximity of Japan to North Korea and the geopolitical tensions in the region. The cybersecurity firm noted a definitive shift in Silent Chollima's tactics, overlapping with the cluster widely tracked as Andariel (aka Onyx Sleet or Silent Chollima), a subgroup within the Lazarus umbrella. It remains unclear whether the TwoPence framework is used exclusively by Stardust Chollima, or if elements of it are shared between other related DPRK adversaries such as Labyrinth Chollima, Ricochet Chollima, or Silent Chollima. The most recent attacks linked to Silent Chollima involved the exploitation of CVE-2023-42793, a severe vulnerability with a CVSS score of 9.8. These attacks were attributed to Diamond Sleet (aka Labyrinth Chollima) and Onyx Sleet (aka Andariel or Silent Chollima). Despite the unique tools and infrastructure leveraged by Silent Chollima, no overlap was identified between this group and Stardust Chollima, suggesting distinct operational strategies amongst these threat actors.