An Examination of Interactive Intrusions by a North Korean APT

The speakers from CrowdStrike's OverWatch hunting team introduce LABYRINTH CHOLLIMA, a North Korea-linked actor pursuing both espionage and revenue. They explain why the group has increasingly targeted cryptocurrency firms and their macOS fleets, and how it selects individuals, especially developers, executives and sales staff, through recruiter-style lures. Common initial access methods such as trojanized crypto-themed applications are also covered.

The core of the talk walks through two intrusions from late 2022 into early 2023, one at a crypto organization and one at a technology company. In each, a multi-stage implant ran light reconnaissance before deeper stages were dropped. Persistence came through launch agents, hidden files and hijacking of legitimate Adobe helper services. The operators collected shell history, SSH keys and stored credentials, used a fake system prompt to harvest passwords, and in one case moved to AWS hosts. Attempts to alter the TCC database and the use of stolen code-signing identities were also described.

The speakers closed by discussing why this activity is hard to track: tooling changes quickly, the footprint is low, and living-off-the-land commands blend into normal developer and administrator activity. Their practical guidance centers on process lineage, unusual launch agent details, unexpected curl use on endpoints, and distinctive code-signing characteristics, which they said had produced useful hunting results.