Httphelper
HTTPHelper is malware associated with DPRK-linked GOLDEN CHOLLIMA activity. The provided content does not describe its standalone functionality in detail, but it explicitly notes shellcode overlaps between HTTPHelper and other malware including PipeDown, DevobRAT, and Anycon, indicating it is part of a shared or related malware toolkit used in cryptocurrency and fintech intrusions. GOLDEN CHOLLIMA is described as a North Korea-linked cluster focused on steady, smaller-scale cryptocurrency thefts, historically using Jeus/AppleJeus-style lures, recruitment fraud, malicious Python packages, and Chromium zero-days. The group targets economically advanced regions with significant cryptocurrency and fintech sectors, including the United States, Canada, South Korea, India, and Western Europe. In late 2024, GOLDEN CHOLLIMA reportedly used recruitment-themed malicious Python packages against a European fintech company, pivoted into the victim cloud environment to access IAM configurations and cloud resources, and diverted cryptocurrency to adversary-controlled wallets. The content also associates GOLDEN CHOLLIMA with deployments of SnakeBaker and NodalBaker at fintech firms. For HTTPHelper specifically, the only high-confidence detail provided is its overlap with this broader GOLDEN CHOLLIMA fintech-targeting malware ecosystem; no specific infection vector, platform, persistence mechanism, or indicators of compromise are directly provided for HTTPHelper itself in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Subsequent variants exhibit shellcode overlaps with Pipedown, Devobrat, Httphelper, and Anycon.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Implant/tooling component in a specialized fintech targeting toolkit; linked to other malware via shellcode overlap.
Referenced as a related malware family showing shellcode overlap with later Jeus/AppleJeus variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.