Ch-Ch-Changes: The Arc of the CHOLLIMA’s and DPRK’s State-Driven Cyber Ecosystem
summary
Since 2015 five CHOLLIMA-aligned adversaries (Silent, Velvet, Ricochet, Stardust, Labyrinth) diversify missions, develop distinct toolsets and mix espionage, theft and sabotage; destructive MBR wipers are repurposed as diversions for intrusions, not just visible sabotage. Targeting scope expands globally, tempo and tooling mature, and operations generate about $2 billion while North Korea’s GDP contracts ~4.1%. The framework combines state direction, sanction-driven revenue needs and reorganization to produce a self-sustaining, multipurpose CNO ecosystem.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:20North Koreas Cyber Operations
- 2:47Whats Driving These Changes
- 5:08Motivations
- 6:45Destructive Tooling
- 8:06Increase in Tempo
related talks
10mCCyberattacks: Is the Juice Worth the Squeeze?
09mDisrupting Cyber Adversaries: Meta's Approach to Deterrence
16mNation-State Threats in the Open-Source Software Supply Chain
35m"We Are About to Land": How CloudDragon Turns a Nightmare Into Reality
53mDo North Korean Hackers Threaten You and Your Company Too?
42mCrypto Confiscation as a Service
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
27mKeynote