Labyrinth Chollima’s primary goals include espionage (targeting government entities, defense, and media), generating financial gains to circumvent international sanctions, and conducting destructive attacks for retaliation or political messaging.

The group employs spear phishing with malicious links or attachments, watering-hole attacks targeting strategic websites, and exploitation of vulnerabilities in exposed servers to gain initial access. To evade detection, they utilize custom malware and tradecraft such as DLL side-loading and signed binaries.

Labyrinth Chollima executes credential theft using keyloggers and tools like Mimikatz, along with custom tools for lateral movement (e.g., PsExec and WMI). Their operations culminate in long-term espionage, cryptocurrency theft, or sabotage via disk-wiping malware.