Case crowdstrike-famous-chollima-genaiState actor AI opsUnited States
CrowdStrike: DPRK's FAMOUS CHOLLIMA used GenAI to infiltrate 320+ companies as IT workers
CrowdStrike's 2025 Threat Hunting Report said North Korea's FAMOUS CHOLLIMA used generative AI across its insider scheme, from fake resumes and deepfaked interviews to on-the-job work, infiltrating 320+ firms in a year.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 4, 2025
- Location
- United States
- Target
- More than 320 companies employing remote IT contractors
- Severity
- High
- Triggered by
- FAMOUS CHOLLIMA
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
CrowdStrike's 2025 Threat Hunting Report said North Korea's FAMOUS CHOLLIMA used generative AI across its insider scheme, from fake resumes and deepfaked interviews to on-the-job work, infiltrating 320+ firms in a year.
Impact: Over 320 companies infiltrated; salaries diverted to the DPRK and insider access gained.
Who triggered it
Actor: FAMOUS CHOLLIMA
Attribution: CrowdStrike attributes FAMOUS CHOLLIMA to North Korea; the report also cited a 220 percent year-on-year rise in infiltrated companies.
Motive: Sanctions-evading revenue for the DPRK regime
How it happened
Attack vector: AI-generated application materials, deepfake video interviews, AI-assisted coding on the job under stolen or fabricated identities
Root cause: Remote hiring pipelines lacked identity verification able to detect AI-fabricated personas
Timeline
- Start of the twelve-month reporting window
- CrowdStrike releases the 2025 Threat Hunting Report at Black Hat USA
Response
CrowdStrike published hunting guidance; the report also noted EMBER BEAR using GenAI for influence content.
Current status: Ongoing
Sources (open in a new tab)
- CrowdStrike press release ir.crowdstrike.com
- Business Wire businesswire.com
Cite this case
CrowdStrike: DPRK's FAMOUS CHOLLIMA used GenAI to infiltrate 320+ companies as IT workers. AI Threat Watch, case crowdstrike-famous-chollima-genai, Aug 4, 2025. https://aithreat.io/cases/crowdstrike-famous-chollima-genai/
Permanent link: https://aithreat.io/cases/crowdstrike-famous-chollima-genai/