CrowdStrike blog
GOLDEN CHOLLIMA recruitment-fraud intrusion at a European fintech company and cryptocurrency diversion (late 2024) · January 29, 2026
In late 2024, the adversary delivered malicious Python packages via recruitment fraud to a European fintech company. They pivoted to the victim’s cloud environment to access IAM configurations and associated cloud resources, and ultimately managed to divert the victim’s cryptocurrency to adversary-controlled wallets.