NK Hackers Pose as IT Staff for Funds

North Korean state-sponsored hackers have significantly increased their presence in the tech sector, posing as remote IT professionals and recruiters. The cybersecurity report indicates that these operatives accounted for approximately half of all documented 'hands-on-keyboard' intrusions at U.S. tech companies over the past year, from April 2025 to May 2026.

The hacking group identified as 'Famous Chollima' was behind 47% of these state-backed attacks targeting the technology industry. These intrusions typically begin with compromised credentials, allowing human hackers to use existing system tools for persistent access. This method circumvents traditional automated malware defenses.

Famous Chollima employs sophisticated tactics, including AI-powered deepfake images and fraudulent identification documents to impersonate individuals and apply for remote positions. This strategy is partly driven by international sanctions against North Korea. Once embedded, these hackers not only steal intellectual property and sensitive data but also earn salaries that are funneled back to the regime.

Furthermore, the group actively targets blockchain developers to illicitly acquire cryptocurrency, a vital resource for Pyongyang to bypass global financial restrictions. North Korea has reportedly amassed billions of dollars through stolen cryptocurrency, with an estimated $2 billion acquired in 2025 alone.