Isolated by severe global economic sanctions, the North Korean government increasingly relies on digital espionage to fund its weapons development programs. A newly published threat assessment from CrowdStrike reveals exactly how sophisticated this operation has become. Between April 2025 and March 2026, a North Korean state-sponsored hacking unit known as FAMOUS CHOLLIMA executed 47% of all state-directed cyberattacks against global technology companies.
These operatives are not just breaching firewalls from the outside. They are walking straight through the digital front door by getting hired as remote software engineers.
The infiltration tactics read like science fiction. According to a detailed report by Forbes, these hackers use artificial intelligence to construct entirely fake identities. They deploy real-time deepfake video filters and voice-changing software to breeze through corporate video interviews. Once embedded inside a company’s network, they systematically target blockchain developers to steal cryptocurrency. At the same time, they route their six-figure corporate salaries directly back to Pyongyang.
The scale of this operation touches nearly every corner of the tech industry. Rival cybersecurity firm Mandiant publicly confirmed that almost every Fortune 500 company has been targeted by these fraudulent applicants. Even tech giants are struggling to filter them out. Amazon blocked over 1,800 suspected North Korean applicants starting in April 2024, and cybersecurity training firm KnowBe4 admitted to inadvertently hiring a deepfake applicant.
International law enforcement is actively pushing back. The United States, working alongside 15 allied governments, recently initiated a coordinated campaign to dismantle the technological infrastructure and cryptocurrency laundering networks supporting FAMOUS CHOLLIMA.
Why Deepfake Interviews Are Breaking Traditional HR Protocols
The integration of generative AI into employment fraud fundamentally breaks standard background checks. CrowdStrike documented a 220% year-over-year surge in incidents involving fraudulent IT workers. This specific metric shows how quickly state-sponsored units are abandoning traditional brute-force hacking in favor of social engineering.
By paying AI avatars to write code, tech companies are accidentally granting highly trained state operatives direct administrative access to their most sensitive internal databases. The reliance on remote-first engineering teams combined with accessible deepfake technology allows foreign actors to operate securely behind a company’s own firewall.