CrowdStrike: North Korean Group Behind 47% of Tech Firm Intrusions via Remote Developer Jobs
FAMOUS CHOLLIMA conducted remote developer operations and cryptocurrency theft across three continents from April 2025 to March 2026. CrowdStrike documented the activity in its annual report released Tuesday.
ForbesFAMOUS CHOLLIMA, a North Korean-backed hacking unit, accounted for 47% of all hands-on-keyboard intrusions targeting tech companies across North America, Europe and Asia between April 2025 and March 2026, CrowdStrike reported Tuesday. The group carried out extensive operations targeting remote software developer roles.
After securing those positions, the hackers deployed malware and stole cryptocurrency from blockchain developers, the report found.
Hackers benefited from a surge in remote positions in recent years and a North Korean education system that produces a substantial pool of skilled IT workers, CrowdStrike said. The jobs they acquired provided salaries that exceeded typical earning potential in North Korea. S.
Conducted a campaign against FAMOUS CHOLLIMA’s technology and its cryptocurrency operations with 15 other governments, according to CrowdStrike. AI development has accelerated hacking capabilities in sophistication, scale and speed, CrowdStrike warned. FAMOUS CHOLLIMA relied on AI to enhance their effectiveness, the cybersecurity firm said.
Anthropic will release a public version of its Mythos tool as soon as Tuesday, The Information reported. The company has claimed the model is capable of exploiting security flaws in every major operating system and web browser and warned it was too dangerous to release to the public.
Some companies received early access to Mythos in April, including Amazon, Apple, Google, Nvidia and Microsoft, Bloomberg reported.
Anthropic called its project an urgent attempt to put these capabilities to work for defensive purposes. S. government about Mythos, adding the company’s position is the government has to know about this stuff.
U.S. has targeted North Korean hackers for years, including a recent series of sanctions on hacker groups relying on IT workers. North Korea uses IT workers to generate revenue for ballistic missile programs and its weapons of mass destruction, the Treasury Department said last year.
