North Korean Hackers Behind Half of Major US Tech Cyber Intrusions
A new report by cybersecurity giant CrowdStrike has revealed that North Korean state-sponsored hackers were responsible for nearly half of all high-level “hands-on-keyboard” cyber intrusions targeting U.S. technology companies over the past year.
According to CrowdStrike’s 2026 Technology Threat Landscape Report, hackers linked to North Korea accounted for 47 percent of such sophisticated cyber operations between April 2025 and May 2026.
AI-Powered Infiltration Tactics
The report identifies the hacking group as Famous Chollima, which has increasingly used artificial intelligence to infiltrate technology companies by posing as remote software developers, coders, and IT professionals.
Unlike conventional cyberattacks that rely on malware, these operations involve human-controlled intrusions where attackers actively interact with targeted systems, making them significantly harder to detect through traditional cybersecurity tools.
Deepfake Interviews and Fake Identities
According to the report, the group uses AI-generated deepfake technology during online job interviews, enabling operatives to appear as U.S. or European citizens in real time.
The attackers are also reported to use stolen passports, forged driver's licenses, and fabricated identity documents to secure employment at technology firms.
Once hired, they allegedly collect salaries while simultaneously gaining access to sensitive corporate information, source code, intellectual property, and internal systems.
Security researchers warn that if their identities are exposed, some operatives shift to extortion tactics, threatening to leak stolen data unless companies pay substantial ransom demands.
Focus on Crypto and Blockchain Firms
The report notes that blockchain and cryptocurrency companies remain primary targets for the group.
With North Korea facing extensive international sanctions, cyber-enabled financial theft has become a significant source of revenue. According to CrowdStrike, North Korean-linked actors stole an estimated $2.02 billion worth of cryptocurrency from fintech and crypto platforms worldwide during 2025.
Growing Insider Threat
Cybersecurity analysts say the rise of AI-powered identity deception is creating a new challenge for technology companies.
As organizations increasingly strengthen defenses against external hackers, detecting insider threats—particularly individuals using AI-generated identities to gain legitimate access—has become a critical security concern.
Experts warn that advanced AI tools are now being used not only to automate cyberattacks but also to manipulate recruitment and verification processes, making workforce security screening more important than ever.
DBTech/BMT/OR
