Threat Actor Profile
Silent Chollima
Silent Chollima is a sophisticated threat actor group affiliated with the Democratic People's Republic of Korea (DPRK), first observed around 2007-2009. Known for its strategic espionage and destructive cyber capabilities, this group has recently expanded its operations to include financially motivated attacks like ransomware and extortion to fund its activities. It operates with a high degree of technical skill, often exploiting known vulnerabilities and using custom malware.
Threat Actor Profile
Silent Chollima
It is important to note that security vendors often use different names for the same or overlapping North Korean threat groups. Common aliases for this cluster include Andariel, Onyx Sleet, PLUTONIUM, Stonefly, DarkSeoul, and APT45. Analysts should focus on the specific tactics and tools rather than relying on a single name for attribution.
Country of Origin
Silent Chollima is a state-sponsored threat actor group operating out of the Democratic People's Republic of Korea (DPRK), also known as North Korea.
Members
The exact size and structure of Silent Chollima are unknown. However, analysis of their campaigns suggests a well-organized and resourced group of skilled operators. In July 2024, the U.S. Department of Justice unsealed an indictment against an individual named Rim Jong Hyok, linking him to this DPRK-affiliated cluster for ransomware activities, providing a rare glimpse into a potential member.
Leadership
Specific leadership details for Silent Chollima are not publicly known. As a state-sponsored group, its operations are directed by North Korea's strategic objectives, but individual leaders are not typically identified in public reporting.
Silent Chollima TTPs
Silent Chollima employs a versatile set of tactics, techniques, and procedures (TTPs) that blend traditional espionage with financially motivated cybercrime. Their approach demonstrates adaptability, using both custom-built tools and commodity malware to achieve their objectives.
Tactics
The group's primary motivations have historically revolved around strategic espionage to support North Korea's military and nuclear programs. This includes stealing technical, military, and industrial intellectual property. More recently, their tactics have expanded to include large-scale extortion and ransomware campaigns, likely to generate revenue and fund further operations.
Techniques
To achieve their goals, Silent Chollima operators utilize a range of techniques to gain and maintain access to target networks.
Initial Access: They frequently use spear-phishing emails containing malicious attachments (like LNK, HTA, or weaponized Office documents). They are also known for conducting watering-hole attacks and exploiting internet-facing services, such as web servers, using both zero-day and N-day vulnerabilities like the Log4Shell family and TeamCity CVE-2023-42793.
Persistence and Lateral Movement: Once inside a network, the group uses scheduled tasks, abuses Remote Monitoring and Management (RMM) tools, and deploys custom backdoors to maintain persistence. For lateral movement, they rely on credential dumping with tools like Mimikatz and create proxies or tunnels using open-source software like Ngrok and Chisel.
Procedures
Silent Chollima's procedures often involve a mix of custom and publicly available tools.
Web Shells: After exploiting a web server, they commonly deploy web shells to ensure persistent access and facilitate further commands.
Custom Malware: The group uses a distinct arsenal of custom malware, including backdoors and RATs like Dtrack (Preft), Dora RAT, and TigerRAT.
Commodity Tools: They supplement their custom tools with open-source and commodity software like Sliver, masscan, and PuTTY/Plink to carry out their attacks.
Extortion: In ransomware campaigns, they exfiltrate large volumes of sensitive data before deploying encryption malware, then use the threat of public data leaks to extort victims.
Want to Shut Down Threats Before They Start?
Notable Cyberattacks
Silent Chollima has been active since at least 2007, but recent events highlight its evolving focus.
-
2023-2025 Shift to Extortion: Multiple security vendors observed the group's increased focus on ransomware and extortion. This period saw them exploiting N-day vulnerabilities, such as the TeamCity RCE (CVE-2023-42793), to gain initial access for financial gain.
Law Enforcement & Arrests
In July 2024, the U.S. Department of Justice unsealed an indictment charging Rim Jong Hyok, a North Korean national, for conspiring to deploy ransomware against U.S. healthcare facilities and launder the illicit proceeds. This action, coordinated with other government agencies, highlights international efforts to disrupt the financial networks that fund DPRK's malicious cyber activities.
How to Defend Against Silent Chollima
Patch Management: Promptly patch internet-facing services, prioritizing known exploited vulnerabilities like Log4Shell and TeamCity.
Harden Web Servers: Monitor for web shell creation, unusual script changes (PHP, ASP), and anomalous processes originating from web server services.
Identity and Access Management: Enforce strong multi-factor authentication (MFA) and limit the use of privileged credentials to reduce the impact of credential theft.
Endpoint and Network Monitoring: Use an Endpoint Detection and Response (EDR) solution to monitor for credential dumping behavior (Mimikatz), suspicious process injections, and command-and-control (C2) patterns. Huntress Managed EDR service, backed by a 24/7 SOC, can detect and respond to these techniques in minutes.
Email Security: Implement robust anti-phishing controls, including attachment sandboxing and blocking of high-risk file types like LNK and HTA.
Network Segmentation: Restrict access to critical systems (e.g., intellectual property repositories, industrial control systems) and limit the use of RMM tools.
Incident Response Plan: Maintain and test an incident response plan designed for ransomware scenarios. This includes keeping offline backups and regularly testing recovery procedures.
References
Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
