# Silent Chollima

> As of 2026-11-12, Silent Chollima is a threat actor tracked by Threadlinqs Intelligence across 5 threats spanning threat intel, apt, malware. ATT&CK coverage spans 75 techniques across 15 tactics in 5 of 5 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1059.001 (PowerShell), T1082 (System Information Discovery).

- **Tracked threats:** 5
- **Categories:** THREAT_INTEL, APT, MALWARE, VULNERABILITY
- **As of:** 2026-11-12

## ATT&CK techniques observed

75 techniques observed across 5 of 5 tracked threats. Tactics: Stealth (formerly Defense Evasion) (15), Execution (9), Initial Access (7), Persistence (7), Command and Control (6), Reconnaissance (6).

- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 3 of 5 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 3 of 5 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 3 of 5 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 3 of 5 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 5 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 2 of 5 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 2 of 5 tracked threats
- [T1053.005](https://intel.threadlinqs.com/technique/T1053.005) Scheduled Task/Job: Scheduled Task — Persistence — observed in 2 of 5 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 2 of 5 tracked threats
- [T1059.005](https://intel.threadlinqs.com/technique/T1059.005) Visual Basic — Execution — observed in 2 of 5 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 2 of 5 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 2 of 5 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 2 of 5 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 2 of 5 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 2 of 5 tracked threats

## Tracked threats

- [Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709](https://intel.threadlinqs.com/threat/TL-2026-5819) — HIGH
- [North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)](https://intel.threadlinqs.com/threat/TL-2026-4755) — HIGH
- [Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)](https://intel.threadlinqs.com/threat/TL-2026-1908) — CRITICAL
- [Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)](https://intel.threadlinqs.com/threat/TL-2026-0869) — HIGH
- [Apache ActiveMQ OpenWire Deserialization RCE (CVE-2023-46604) — 6,400 Brokers Actively Exploited by HelloKitty, Kinsing, TellYouThePass and Andariel (Lazarus)](https://intel.threadlinqs.com/threat/TL-2026-0404) — CRITICAL

## Related CVEs

10 CVEs referenced by tracked Silent Chollima activity.

- [CVE-2026-91000](https://intel.threadlinqs.com/cve/CVE-2026-91000)
- [CVE-2026-125883](https://intel.threadlinqs.com/cve/CVE-2026-125883)
- [CVE-2026-125882](https://intel.threadlinqs.com/cve/CVE-2026-125882)
- [CVE-2026-125881](https://intel.threadlinqs.com/cve/CVE-2026-125881)
- [CVE-2026-125880](https://intel.threadlinqs.com/cve/CVE-2026-125880)
- [CVE-2026-125879](https://intel.threadlinqs.com/cve/CVE-2026-125879)
- [CVE-2026-125878](https://intel.threadlinqs.com/cve/CVE-2026-125878)
- [CVE-2024-1709](https://intel.threadlinqs.com/cve/CVE-2024-1709)
- [CVE-2023-46604](https://intel.threadlinqs.com/cve/CVE-2023-46604)
- [CVE-2017-8291](https://intel.threadlinqs.com/cve/CVE-2017-8291)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Silent%20Chollima