Stardust Chollima

Stardust Chollima is a recognized threat actor in the cybersecurity industry, primarily known for its malicious activities aimed at acquiring funds. This group has been linked to various high-profile cyber-attacks and fraudulent activities since 2015. Stardust Chollima has been associated with the fraudulent abuse of compromised bank-operated SWIFT system endpoints, the FASTCash ATM cash-outs reported in October 2018, and significant cryptocurrency thefts. The group has been tracked under different names by various cybersecurity firms, including APT38 by FireEye, Bluenoroff by Kaspersky, Lazarus Group by ESTSecurity, and BeagleBoyz, among others. The operational framework of Stardust Chollima appears to be complex and potentially interconnected with other DPRK adversaries such as Labyrinth Chollima, Ricochet Chollima, and Silent Chollima. However, it remains unclear if elements of the TwoPence framework used by Stardust Chollima are shared among these groups. In August, the group was reported to have debuted the SpectralBlur malware, according to Proofpoint threat researcher Greg Lesnewich. Furthermore, there's a technical overlap between the WannaCry ransomware, which began self-propagating in May 2017, and both Stardust Chollima and Labyrinth Chollima. While there seems to be a degree of operational overlap with other groups, no direct link has been identified between Stardust Chollima and Silent Chollima, another threat actor involved in revenue generation attempts. Both groups leverage unique tools and infrastructure in their operations. The cybersecurity industry continues to monitor these threat actors closely, and companies are advised to incorporate intelligence on these groups into their security strategies. Cybersecurity firm CrowdStrike offers resources on how to integrate this information into an effective defense plan.