Check Point Research
23rd June – Threat Intelligence Report · 2025-06-23
Researchers have identified a new Python-based version of the GolangGhost RAT, dubbed PylangGhost, deployed by the North Korean-linked group Famous Chollima. Active since May 2025, the Windows-focused malware mirrors its Golang predecessor in capabilities, targeting crypto and blockchain professionals in India via fake job‐interview or skill‐testing sites that trick victims into executing malicious commands.