Velvet Chollima

Velvet Chollima, also known as Kimsuky, APT43, Thallium, Black Banshee, and Emerald Sleet among other names, is a threat actor believed to be based in North Korea. The group has been active since 2012 and is linked to North Korea’s General Reconnaissance Bureau, the country's main military intelligence organization. Known for its focus on social engineering, Velvet Chollima uses various tactics including malicious Chrome browser extensions and app store services to target individuals conducting research on the inter-Korean conflict. The group is tracked by both the U.S. and South Korean governments along with private-sector cybersecurity companies due to their large-scale social engineering campaigns. In 2023, Velvet Chollima notably increased its activities, shifting towards a greater focus on cryptocurrency in addition to its traditional focus on cyber espionage. This shift was marked by the use of evasion and disruption techniques to bypass security tools. The group has also been observed exploiting critical vulnerabilities in widely used remote access tools like ConnectWise ScreenConnect to deploy malware strains similar to the Babyshark malware family, which is associated with the group. Recently, hackers from this group have been exploiting disclosed ScreenConnect vulnerabilities to deploy a new variant of malware, dubbed ToddlerShark by researchers. This new malware overlaps with ReconShark and BabyShark, reconnaissance tools previously used by Velvet Chollima. As a state-sponsored hacking group, Velvet Chollima continues to pose a significant threat to organizations and governments worldwide, particularly those involved in research or activities related to the inter-Korean conflict.