Full Report
Threat hunters saw North Korean operatives almost daily, reflecting a 220% year-over-year increase in activity, CrowdStrike said in a new report. The post CrowdStrike investigated 320 North Korean IT worker cases in the past year appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Famous Chollima (North Korean State-Sponsored Group)
## Attribution & Identity
**Attribution:** North Korea
**Associated Groups:** Mentioned as a state-sponsored group of North Korean technical specialists.
**Aliases:** The article refers to the threat actors broadly as "North Korean operatives" but specifically names **Famous Chollima** as fueling the pace of activity.
## Activity Summary
CrowdStrike investigated over 320 specific incidents involving North Korean operatives gaining remote employment as IT workers over the past year (ending June 30). This represents a **220% year-over-year increase** in observed Famous Chollima activity. These operatives are seeking and gaining technical jobs globally to earn salaries that are subsequently sent back to Pyongyang. The threat group escalated operations throughout the past year, expanding beyond the United States into Europe and Latin America. They are allegedly using the earned funds to finance North Korean weapons programs. Threat hunters observed these operatives almost daily.
## Tactics, Techniques & Procedures
- **Insider Threat/Infiltration:** Gaining remote employment within foreign companies, often holding multiple jobs (sometimes 3-4 simultaneously).
- **Generative AI Utilization:** Extensive use of generative AI across all operational stages:
- Drafting resumes and creating false identities for application.
- Building tools for job research.
- Masking identity during video interviews.
- Answering technical coding assignments.
- Aiding in daily work tasks and managing communications while employed.
- **Hands-on-Keyboard Intrusions:** Observed a 27% year-over-year increase in hands-on-keyboard intrusions, **81% of which involved no malware** (suggesting living-off-the-land or fileless techniques).
- **Cybercrime Focus:** Accounted for 73% of all observed interactive intrusions during the one-year period.
## Targeting
- **Sectors:** Implied sectors needing IT workforce support, including Fortune 500 companies and small-to-midsized organizations.
- **Geography:** Global reach, including the **United States, Europe, and Latin America**.
- **Victims:** Companies employing remote IT workers globally. (No specific company names provided in the summary text).
## Tools & Infrastructure
- **Malware Families Used:** Not explicitly detailed, but the focus on non-malware, hands-on-keyboard intrusions suggests reliance on legitimate tools or fileless execution.
- **Infrastructure (C2, domains, IPs):** No specific infrastructure was detailed in the provided text.
## Implications
The significant increase (220% YOY) in successful infiltration by state-sponsored operatives exploiting IT employment channels demonstrates a sophisticated, evolving espionage and financial collection strategy by North Korea. The heavy reliance on generative AI to bypass hiring scrutiny and execute daily tasks suggests these operatives are adapting rapidly to modern security and HR processes, complicating detection. The resulting funds directly contribute to the nation's strategic weapons programs.
## Mitigations
- Enhanced scrutiny and verification of remote IT workers, specifically during the hiring process (resumes, identity verification, technical interviews).
- Continuous monitoring of internal networks for anomalous activity from new hires, recognizing that a high percentage of intrusions observed were malware-free (hands-on-keyboard).
- Develop security controls specifically aimed at detecting and preventing the use of generative AI tools by insiders for malicious purposes or task execution.