Ricochet Chollima Adversary Profile | CrowdStrike
Archived: 2026-04-05 19:35:44 UTC
Discover the adversaries targeting your industry
 Back to Adversary Universe
RICOCHET CHOLLIMA is a Democratic Peoples’ Republic of Korea (DPRK)-nexus targeted intrusion adversary
that has been involved in espionage operations since at least 2016. RICOCHET CHOLLIMA’s observed
operations have almost exclusively targeted the Republic of Korea (ROK) and are assessed to be focused on ROK
government officials, non-governmental organizations (NGOs), academics, journalists, and D...
https://www.crowdstrike.com/adversaries/ricochet-chollima/
Page 1 of 3

Ricochet Chollima
North Korea, East Asia, Asia
Community Identifiers
ScarCruft, APT37, Group123, Venus121, Inky Squid, Moldy Pisces, TA-RedAnt, Pearl Sleet, Red Eyes, ITG10
Objective
Intelligence Gathering
Motivation
State-Sponsored
Who's targeting your industry?
Today's adversaries are faster, smarter, and better resourced. Know who they are and how to stop them.
View adversaries
https://www.crowdstrike.com/adversaries/ricochet-chollima/
Page 2 of 3

CrowdStrike 2025 Threat Hunting Report
Adversaries weaponize and target AI at scale.
Source: https://www.crowdstrike.com/adversaries/ricochet-chollima/
https://www.crowdstrike.com/adversaries/ricochet-chollima/
Page 3 of 3