Adversary Intelligence — 2026-06-13

CrowdStrike Finds North Korean Famous Chollima Behind Nearly Half of US Tech Sector Cyber Intrusions

BLUFFamous Chollima's 47% share of state-sponsored tech intrusions will likely drive DOJ indictments within the next year, but the sector's hiring-verification gap remains the more urgent vulnerability.

CrowdStrike's 2026 Technology Threat Landscape Report attributes 47% of all state-sponsored hands-on-keyboard intrusions against the tech sector to Famous Chollima over the April 2025 to March 2026 period 12. The group poses as remote developers at tech companies in North America, Europe, and Asia, using AI deepfakes and fraudulent identity documents to pass hiring checks while collecting salaries channeled to the regime 123. Infiltrated operatives exfiltrate intellectual property and threaten disclosure upon detection; related DPRK operations stole approximately $2 billion in cryptocurrency during 2025 23. China-nexus actors accounted for 58% of state-sponsored intrusions targeting the sector; a separate DPRK affiliate, STARDUST CHOLLIMA, compromised the Axios npm package in March 2026, downloaded roughly 100 million times weekly 14.

Analysis
DOJ will likely unseal additional indictments against Famous Chollima-linked IT worker infiltrators within the next 12 months, as prior attribution cycles have reliably triggered enforcement within that window. Moderate confidence rests on DPRK IT worker charging precedent and the operational scale CrowdStrike has now publicly documented. Drawing solely from CrowdStrike's client telemetry, the 47% figure may overstate Famous Chollima's sector-wide dominance among organizations using competing security vendors. STARDUST CHOLLIMA's March 2026 Axios npm compromise widens the potential victim pool beyond directly infiltrated firms. If indictments materialize, compliance teams gain named-actor intelligence to audit active contractor rosters; absent charges, the enforcement backstop motivating stricter hiring-verification mandates dissolves.

4 sources