Sparkdownloader

SparkDownloader is a low-prevalence malware implant associated with DPRK-linked PRESSURE CHOLLIMA operations focused on high-impact cryptocurrency theft. The reporting states PRESSURE CHOLLIMA likely diverged from LABYRINTH CHOLLIMA in early 2019 with SwDownloader, which was then quickly replaced by SparkDownloader; the malware is also tracked publicly as TraderTraitor. PRESSURE CHOLLIMA is described as one of the DPRK’s most technically advanced adversaries, pursuing organizations with significant digital asset holdings globally and being linked to some of the largest recorded cryptocurrency thefts. Within that context, SparkDownloader is part of the malware/tooling lineage used by this cluster alongside other low-prevalence implants and campaigns involving malicious Node.js and Python projects that deliver malware such as Scuzzyfuss and Twopence Electric. The broader reporting ties these operations to shared DPRK malware development lineages and infrastructure derived from earlier frameworks, while emphasizing PRESSURE CHOLLIMA’s role in large-scale crypto heists. No specific SparkDownloader infection chain, platform details, or standalone IOCs are directly provided in the content beyond its succession from SwDownloader and public tracking as TraderTraitor.