Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Silent Chollima · Unknown · assessed origin North Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

Silent Chollima

  • OperationTroy
  • Guardian of Peace
  • GOP
  • WHOis Team
  • Andariel
  • Subgroup: Andariel
  • Onyx Sleet
  • PLUTONIUM

MITRE G0138 ↗

Silent Chollima — ATT&CK roseSC

attack rose · 12 techniques across 8 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2023-42793

Analyst brief

misp-galaxy + mitre-attack

Andariel is a threat actor that primarily targets South Korean corporations and institutions. They are believed to collaborate with or operate as a subsidiary organization of the Lazarus threat group. WHOIS utilizes spear phishing attacks, watering hole attacks, and supply chain attacks for initial access. They have been known to exploit vulnerabilities and use malware such as Infostealer and TigerRAT.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

12 techniques · 8 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    1 technique

  3. Initial access

    2 techniques

  4. Execution

    2 techniques

  5. Stealth

    1 technique

  6. Discovery

    2 techniques

  7. Collection

    1 technique

  8. Command and control

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
RifdoorS0433 ↗
gh0st RATS0032 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Silent Chollima is cited as exploiting

none on KEV
  1. CVE-2023-427932026-10-17
    1. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

    2. “Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

9 sources
  1. 1.docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution…
  2. 2.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-t…
  3. 3.attack.mitre.org/groups/G0138
  4. 4.web.archive.org/web/20230213154832/http://download.ahnlab.com/global/b…
  5. 5.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactic…
  6. 6.adversary.crowdstrike.com/en-US/adversary/silent-chollima
  7. 7.fsiceat.tistory.com/2
  8. 8.issuemakerslab.com/research3
  9. 9.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…

Track Silent Chollima on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.