DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

LABYRINTH CHOLLIMA targeting of European aerospace and defense manufacturers (2024-2025), logistics and shipping, U.S. manufacturing incl. hydroelectric power

Date (as written)
January 29, 2026
Year
2026
Country
European; U.S., Japanese, and Italian; U.S.-based
Actors (as written)
LABYRINTH CHOLLIMA
Actor pages
LABYRINTH CHOLLIMA
Tags (as written)
manufacturing and defense; aerospace; logistics and shipping; hydroelectric power

Source entries (1)

CrowdStrike blog

LABYRINTH CHOLLIMA targeting of European aerospace and defense manufacturers (2024-2025), logistics and shipping, U.S. manufacturing incl. hydroelectric power · January 29, 2026
LABYRINTH CHOLLIMA operations prioritize targets in the manufacturing and defense sectors, particularly European defense entities and U.S., Japanese, and Italian manufacturing organizations. Throughout 2024 and into 2025, LABYRINTH CHOLLIMA persistently targeted European aerospace corporations using employment-themed lures and exploited zero-day vulnerabilities against defense manufacturers. In the first half of 2025, CrowdStrike Intelligence also observed a growing interest by LABYRINTH CHOLLIMA in logistics and shipping companies. The adversary has also targeted U.S.-based manufacturing companies, including critical infrastructure entities in specialized areas such as hydroelectric power.
https://www.crowdstrike.com/en-us/blog/labyrinth-chollima-evolves-into-three-adversaries/

Suggest a correction on GitHub