# Stardust Chollima

> As of 2026-09-30, Stardust Chollima is a threat actor tracked by Threadlinqs Intelligence across 35 threats spanning supply chain, apt, zero day. ATT&CK coverage spans 227 techniques across 16 tactics in 35 of 35 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1082 (System Information Discovery), T1041 (Exfiltration Over C2 Channel).

- **Tracked threats:** 35
- **Categories:** SUPPLY_CHAIN, APT, ZERO_DAY, VULNERABILITY, MALWARE, THREAT_INTEL, CAMPAIGN, PHISHING
- **As of:** 2026-09-30

## ATT&CK techniques observed

227 techniques observed across 35 of 35 tracked threats. Tactics: Stealth (formerly Defense Evasion) (46), Resource Development (23), Command and Control (22), Persistence (22), Discovery (19), Execution (18).

- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 27 of 35 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 27 of 35 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 22 of 35 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 20 of 35 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 19 of 35 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 18 of 35 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 17 of 35 tracked threats
- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 17 of 35 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 16 of 35 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 15 of 35 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 15 of 35 tracked threats
- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 15 of 35 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 14 of 35 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 14 of 35 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 13 of 35 tracked threats

## Tracked threats

- [Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)](https://intel.threadlinqs.com/threat/TL-2026-2657) — HIGH
- [Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend Compromise and Authorization-Flow Abuse](https://intel.threadlinqs.com/threat/TL-2026-2650) — CRITICAL
- [DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules to Deliver Go RAT with Slack and Arbitrum Sepolia Blockchain C2](https://intel.threadlinqs.com/threat/TL-2026-2635) — HIGH
- [Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)](https://intel.threadlinqs.com/threat/TL-2026-2603) — HIGH
- [Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry](https://intel.threadlinqs.com/threat/TL-2026-2561) — CRITICAL
- [Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time](https://intel.threadlinqs.com/threat/TL-2026-2089) — CRITICAL
- [Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2086) — CRITICAL
- [Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)](https://intel.threadlinqs.com/threat/TL-2026-2085) — CRITICAL
- [Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-2083) — CRITICAL
- [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)](https://intel.threadlinqs.com/threat/TL-2026-1987) — CRITICAL
- [Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)](https://intel.threadlinqs.com/threat/TL-2026-1908) — CRITICAL
- [NullReceiver: DPRK Contagious Interview campaign evolves blockchain C2 with stealthier wallet-trail technique via trojanized npm packages](https://intel.threadlinqs.com/threat/TL-2026-1856) — HIGH
- [North Korea's Lazarus Group Linked to Tool-Sharing with Gunra Ransomware Operators Against South Korean Targets ("Operation Double Barrel")](https://intel.threadlinqs.com/threat/TL-2026-1797) — HIGH
- [State-Sponsored Actors Exploit AnySign4PC Zero-Day via Compromised Watering-Hole Sites to Deploy SIGNBT and COPPERHEDGE Backdoors](https://intel.threadlinqs.com/threat/TL-2026-1780) — CRITICAL
- [Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and Typo-Crypto npm Packages in Supply-Chain Campaign](https://intel.threadlinqs.com/threat/TL-2026-1760) — CRITICAL
- [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — HIGH
- [BlueNoroff Hijacks Trusted Telegram Accounts to Deliver ClickFix Malware via Deepfake Zoom/Teams Calls](https://intel.threadlinqs.com/threat/TL-2026-1720) — HIGH
- [BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency Credentials via ClickFix and AI Deepfake Social Engineering](https://intel.threadlinqs.com/threat/TL-2026-1719) — HIGH
- [BlueNoroff "ClickFake Interview" Zoom/Teams Phishing Kit: AI Deepfake Video Lures, ClickFix PowerShell Loaders, and Crypto Wallet/iCloud Keychain Theft](https://intel.threadlinqs.com/threat/TL-2026-1678) — HIGH
- [NSFOCUS 2025 APT Group Research Annual Report: 662 Active APT Groups, 42 Newly Disclosed, AI-Weaponized Attacks Surge 89% YoY](https://intel.threadlinqs.com/threat/TL-2026-1559) — MEDIUM
- [ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise](https://intel.threadlinqs.com/threat/TL-2026-1287) — MEDIUM
- [PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret)](https://intel.threadlinqs.com/threat/TL-2026-1215) — HIGH
- [ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)](https://intel.threadlinqs.com/threat/TL-2026-1127) — HIGH
- [Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)](https://intel.threadlinqs.com/threat/TL-2026-1030) — HIGH
- [ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques](https://intel.threadlinqs.com/threat/TL-2026-1027) — HIGH
- [Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account](https://intel.threadlinqs.com/threat/TL-2026-0898) — CRITICAL
- [Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromised](https://intel.threadlinqs.com/threat/TL-2026-0977) — CRITICAL
- [Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer](https://intel.threadlinqs.com/threat/TL-2026-0834) — CRITICAL
- [Sapphire Sleet (DPRK/BlueNoroff) macOS Intrusion Campaign Targeting Cryptocurrency, Web3, and Venture Capital Sectors](https://intel.threadlinqs.com/threat/TL-2026-0383) — HIGH
- [Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2](https://intel.threadlinqs.com/threat/TL-2026-0351) — CRITICAL
- [Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)](https://intel.threadlinqs.com/threat/TL-2026-0314) — CRITICAL
- [Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency](https://intel.threadlinqs.com/threat/TL-2026-0311) — CRITICAL
- [UNC1069 Compromises Axios NPM Package in Supply Chain Attack Deploying WAVESHAPER.V2 Cross-Platform Backdoor](https://intel.threadlinqs.com/threat/TL-2026-0309) — CRITICAL
- [North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency](https://intel.threadlinqs.com/threat/TL-2026-0305) — CRITICAL
- [UNC4899/Jade Sleet Cryptocurrency Exchange Breach via AirDrop Trojanization and Cloud Infrastructure Compromise](https://intel.threadlinqs.com/threat/TL-2026-0202) — CRITICAL

## Related CVEs

40 of 60 CVEs referenced by tracked Stardust Chollima activity.

- [CVE-2026-72971](https://intel.threadlinqs.com/cve/CVE-2026-72971)
- [CVE-2026-70332](https://intel.threadlinqs.com/cve/CVE-2026-70332)
- [CVE-2026-70130](https://intel.threadlinqs.com/cve/CVE-2026-70130)
- [CVE-2026-68823](https://intel.threadlinqs.com/cve/CVE-2026-68823)
- [CVE-2026-68820](https://intel.threadlinqs.com/cve/CVE-2026-68820)
- [CVE-2026-68816](https://intel.threadlinqs.com/cve/CVE-2026-68816)
- [CVE-2026-68804](https://intel.threadlinqs.com/cve/CVE-2026-68804)
- [CVE-2026-68794](https://intel.threadlinqs.com/cve/CVE-2026-68794)
- [CVE-2026-65813](https://intel.threadlinqs.com/cve/CVE-2026-65813)
- [CVE-2026-65789](https://intel.threadlinqs.com/cve/CVE-2026-65789)
- [CVE-2026-65665](https://intel.threadlinqs.com/cve/CVE-2026-65665)
- [CVE-2026-65657](https://intel.threadlinqs.com/cve/CVE-2026-65657)
- [CVE-2026-64921](https://intel.threadlinqs.com/cve/CVE-2026-64921)
- [CVE-2026-64911](https://intel.threadlinqs.com/cve/CVE-2026-64911)
- [CVE-2026-64910](https://intel.threadlinqs.com/cve/CVE-2026-64910)
- [CVE-2026-64909](https://intel.threadlinqs.com/cve/CVE-2026-64909)
- [CVE-2026-64907](https://intel.threadlinqs.com/cve/CVE-2026-64907)
- [CVE-2026-64903](https://intel.threadlinqs.com/cve/CVE-2026-64903)
- [CVE-2026-64898](https://intel.threadlinqs.com/cve/CVE-2026-64898)
- [CVE-2026-63532](https://intel.threadlinqs.com/cve/CVE-2026-63532)
- [CVE-2026-63526](https://intel.threadlinqs.com/cve/CVE-2026-63526)
- [CVE-2026-63525](https://intel.threadlinqs.com/cve/CVE-2026-63525)
- [CVE-2026-63520](https://intel.threadlinqs.com/cve/CVE-2026-63520)
- [CVE-2026-63518](https://intel.threadlinqs.com/cve/CVE-2026-63518)
- [CVE-2026-63515](https://intel.threadlinqs.com/cve/CVE-2026-63515)
- [CVE-2026-62915](https://intel.threadlinqs.com/cve/CVE-2026-62915)
- [CVE-2026-62914](https://intel.threadlinqs.com/cve/CVE-2026-62914)
- [CVE-2026-62913](https://intel.threadlinqs.com/cve/CVE-2026-62913)
- [CVE-2026-62912](https://intel.threadlinqs.com/cve/CVE-2026-62912)
- [CVE-2026-62911](https://intel.threadlinqs.com/cve/CVE-2026-62911)
- [CVE-2026-62910](https://intel.threadlinqs.com/cve/CVE-2026-62910)
- [CVE-2026-62893](https://intel.threadlinqs.com/cve/CVE-2026-62893)
- [CVE-2026-62890](https://intel.threadlinqs.com/cve/CVE-2026-62890)
- [CVE-2026-62889](https://intel.threadlinqs.com/cve/CVE-2026-62889)
- [CVE-2026-62878](https://intel.threadlinqs.com/cve/CVE-2026-62878)
- [CVE-2026-62869](https://intel.threadlinqs.com/cve/CVE-2026-62869)
- [CVE-2026-62832](https://intel.threadlinqs.com/cve/CVE-2026-62832)
- [CVE-2026-62827](https://intel.threadlinqs.com/cve/CVE-2026-62827)
- [CVE-2026-62824](https://intel.threadlinqs.com/cve/CVE-2026-62824)
- [CVE-2026-62823](https://intel.threadlinqs.com/cve/CVE-2026-62823)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Stardust%20Chollima