North Koreans behind nearly half of US tech industry hacks, says CrowdStrike

A recent analysis by cybersecurity firm CrowdStrike reveals alarming statistics surrounding North Korean cybercriminals who have infiltrated U.S. tech companies. The report indicates that these hackers, often masquerading as remote IT professionals and online recruiters, accounted for nearly half of all documented cyber intrusions in the sector over the past year. According to CrowdStrike's annual cybersecurity report, the period from April 2025 to May 2026 saw North Korean operatives, identified as part of a group dubbed "Famous Chollima," responsible for 47% of state-sponsored attacks targeting the tech industry. This surge in activity underscores the escalating threat posed by North Korean hackers, who persistently aim to steal sensitive information and cryptocurrency to finance the regime's prohibited nuclear weapons initiatives. These cyber attacks typically commence with the acquisition of stolen passwords or credentials, allowing hackers to exploit legitimate tools within their targets' systems. This technique enables them to maintain persistent access without detection. Famous Chollima is notorious for adopting the identities of tech professionals—developers and IT specialists—applying for remote roles across U.S., European, and Asian companies under false identities. To enhance their deception, these hackers utilize advanced AI technology to create deepfake images, simulating the appearances of actual individuals. They combine this with forged identification documents, such as stolen passports, to convincingly impersonate citizens from various countries. This tactic is particularly advantageous given North Korea's extensive sanctions imposed by Western nations and the United Nations due to its ongoing nuclear development. Once they gain employment, these hackers not only receive salaries from the companies they infiltrate, but they also siphon off intellectual property and sensitive corporate data. In many cases, the stolen information is leveraged to extort companies, with threats of public exposure if ransoms are not paid. Additionally, these operatives target blockchain developers, seeking to pilfer substantial amounts of cryptocurrency, which the North Korean regime uses to navigate its restrictions from the Western banking system. Over the past years, North Korea has amassed billions in stolen cryptocurrency, with an estimated $2 billion acquired in 2025 alone.