North Korean Hackers—Posing As Fake IT Workers—Behind Nearly Half Of All Tech Firm Attacks, Report Says

BreakingBusinessNorth Korean Hackers—Posing As Fake IT Workers—Behind Nearly Half Of All Tech Firm Attacks, Report SaysByTy Roush,Forbes Staff. Ty Roush is a breaking news reporter based in New York City.Follow AuthorJun 09, 2026, 12:52pm EDTToplineOne North Korean hacking group that posed as fake IT workers accounted for nearly half of all state-sponsored attacks on tech companies, according to an annual report Tuesday from the cybersecurity firm CrowdStrike, as concerns mount about advances in AI. One North Korean group accounted for nearly half of all state-sponsored hacks on tech companies, a report found.SOPA Images/LightRocket via Getty ImagesKey FactsFAMOUS CHOLLIMA, a North Korean-backed hacking unit, accounted for 47% of all hands-on-keyboard intrusions—a cyberattack in which a human controls and interacts with a system rather than relying solely on malware—targeting tech companies across North America, Europe and Asia between April 2025 and March, CrowdStrike reported.The group carried out “extensive” operations targeting remote software developer roles, after which they deployed malware and stole cryptocurrency from blockchain developers, the report found.Hackers benefited from a surge in remote positions in recent years and a North Korean education system that produces a “substantial pool” of skilled IT workers, CrowdStrike said, noting the jobs they acquired provided salaries that “significantly” exceeded typical earning potential in North Korea.The U.S. conducted a campaign against FAMOUS CHOLLIMA’s technology and its cryptocurrency operations with 15 other unspecified governments, according to CrowdStrike (U.S. Cyber Command did not immediately respond to a request for comment). if (!window.cnxel) { window.cnxel = {}; window.cnxel.cmd = []; var iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.onload = function() { var iframeDoc = iframe.contentWindow.document; var script = iframeDoc.createElement('script'); script.src =...