Cisco Talos Blog: Famous Chollima deploying Python version of GolangGhost RAT

Jun 18, 2025

—

Source URL: https://blog.talosintelligence.com/python-version-of-golangghost-rat/
Source: Cisco Talos Blog
Title: Famous Chollima deploying Python version of GolangGhost RAT

Feedly Summary: Learn how the North Korean-aligned Famous Chollima is using the a new Python-based RAT, “PylangGhost," to target cryptocurrency and blockchain jobseekers in a campaign affecting users primarily in India.

AI Summary and Description: Yes

**Summary:**
The analysis discusses a newly identified Python-based remote access trojan (RAT) named “PylangGhost,” which is utilized by a North Korean-aligned group, Famous Chollima. PylangGhost targets individuals in the cryptocurrency and blockchain sector through deceptive job recruitment methods. This highlights the evolving tactics in cyber threats and the significance of securing vulnerable user bases.

**Detailed Description:**
The Cisco Talos team has reported on the emergence of “PylangGhost,” a Python variant of the previously known “GolangGhost” RAT. The malware is associated with North Korean cyber activities and has been specifically targeting individuals with cryptocurrency and blockchain expertise. Key points of the report include:

– **Threat Actors and Campaign Details:**
– PylangGhost is identified with Famous Chollima, known for their malicious campaigns and sophistication.
– This group employs tactics such as fake job offers and skill-testing pages to lure victims into executing malicious commands.

– **Methodology of Attack:**
– Potential victims receive invitations to seemingly legitimate job interviews that require them to submit personal information and undergo skill evaluations, often using code intended to set up malware.
– Once victims comply, they unknowingly execute commands that install the PylangGhost trojan on their devices.

– **Technical Insight:**
– Similarities exist between PylangGhost and GolangGhost, with both sharing functional capabilities and a structured approach.
– PylangGhost’s commands allow for extensive remote control, data theft, and interaction with command and control (C2) servers, including the ability to compromise credentials from numerous popular browser extensions.

– **Detection and Protection Measures:**
– Suggested preventive measures include utilizing Cisco’s security products such as Cisco Secure Endpoint, Secure Email, and Secure Firewall to detect and mitigate against these attacks.
– Organizations are advised to implement robust security protocols, including multi-factor authentication, to safeguard against exploitation.

– **Indicators of Compromise (IOCs):**
– The report provides specific SHA256 hashes of the malware components and details concerning previously identified C2 servers and download host names, which can help in threat intelligence and proactive defenses.

This analysis emphasizes the need for professionals in security, particularly within the domains of information security and malware detection, to stay abreast of evolving tactics from cybercriminals, especially those that utilize social engineering to exploit human behavior. Understanding the specific targets and techniques employed by such actors is crucial in developing effective defenses against increasingly sophisticated threats.

2 5 a access Act active defense AI analysis and app Aria art as attack attacks authentication based Behavior Bi blockchain browser browser extension Browser Extensions by C C2 C2 server C2 servers campaigns capabilities CERN chain CI CIA Cisco Cisco Talos co code Col command control credential credentials Crypto cryptocurrency cyber cyber activities cyber threat cyber threats cybercriminal cybercriminals D data data theft de defense defenses detection device domain domains dual e effective email end endpoint Engineer engineering evaluation evaluations event exp expert expertise exploit Exploitation extensions fact factor authentication fake job offers firewall for function g Gen git Go Golang Group H high Highlight HR http HTTPS human in India indicators indicators of compromise information information security Intel intelligence inter interaction interviews io IoC IoCs J job job interviews jobs k Key l led Li low M malicious campaigns malware malware detection man measures Mila multi multi-factor authentication N new no North Korea North Korean North Korean cyber activities o of off on one organization organizations oS OSINT personal information phi point potential pre preventive measures pro proactive proactive defense proactive defenses product products professionals protection protection measures protocol protocols ps Py Python Q R RCE recruitment red remote Remote Access Remote Access Trojan remote control report Ro robust security RoT row s safe sec sector secure security security products security protocols server servers SHA sharing Sig Sim size SoC social social engineering sophistication source specific SSE SSO structured structured approach T tactics Tails Talos team tech techniques ted test Testing the theft threat threat actor threat actors threat intel threat intelligence threats to Tor TP Troj trojan UI under up US use user user base Users uth V val Valuation version victims Ware Wi x yt