Tag: citriloader

1 Attack Reports | 0 Vulnerabilities

Attack reports

LABYRINTH CHOLLIMA Evolves into Three Adversaries

The LABYRINTH CHOLLIMA threat group has split into three distinct adversaries: GOLDEN CHOLLIMA, PRESSURE CHOLLIMA, and core LABYRINTH CHOLLIMA. Each subgroup has specialized malware, objectives, and tradecraft. GOLDEN CHOLLIMA and PRESSURE CHOLLIMA focus on cryptocurrency entities, while core LABYR…
espionage
north korea
fudmodule
cryptocurrency
zero-day
cloud
fintech
dprk
applejeus
manuscrypt
2026-01-30
alertconf
anycon
backdoor.apt.fakewinhttphelper
brambul
bubblewrap
citriloader
devobrat
dozer
ghostship
hawup
hawup rat
hiberrat
hoplight
httphoplight
joanap
kordll
kordll bot
koredos
magikcookie
matanet
neddnloader
nodalbaker
openssl downloader
pipedown
scuzzyfuss
snakebaker
sparkdownloader
stackeyflate
statussymbol
swdownloader
twopence electric
undergroundrat
winwebdown
Published: January 30, 2026
Downloadable IOCs: 33
Click here to see more Attack Reports