The Reveal Platform
Intel Name: Famous chollima deploying python version of golangghost rat
Date of Scan: June 19, 2025
Impact: Medium
Summary: In May 2025, the North Korean-aligned threat actor Famous Chollima began deploying a Python-based version of their remote access trojan (RAT) called PylangGhost, which shares many capabilities with the previously known GolangGhost RAT. The Python RAT targets Windows systems, while the Golang version continues to target MacOS users. Recent campaigns focus on employees experienced in cryptocurrency and blockchain, primarily affecting a small number of users in India. Linux users are not targeted.
