Famous Chollima: North Korea’s Fake Remote Workers

Famous Chollima is CrowdStrike’s name for a North Korea (DPRK) operation that generates revenue for the sanctioned regime through fraudulent remote employment and related data theft and extortion. It overlaps adjacent vendor clusters — Nickel Tapestry (Secureworks), UNC5267 (Mandiant/Google) and the “Contagious Interview” job-lure malware campaign — which have different scopes and should be described as overlapping rather than identical. The DPRK attribution is high confidence, corroborated by CrowdStrike, Mandiant, Microsoft and multiple U.S. Department of Justice indictments.

Attribution

North Korean, assessed at high confidence across multiple vendors and U.S. DOJ actions. The motivation is revenue for the sanctioned regime, plus data theft and extortion. Vendor scopes differ: some treat Famous Chollima as the IT-worker operation specifically, others fold in the Contagious Interview / DEV#POPPER malware campaign — we keep them as overlapping clusters.

Two Linked Operations

• IT-worker fraud: operatives use fraudulent identities — often with generative-AI-assisted resumes and video-interview masking — to get hired as remote developers at mostly U.S. technology firms, obtaining legitimate insider access. U.S.-based “laptop farms” make the workers appear domestic.
• Contagious Interview: the technical counterpart, where fake recruiters lure developers into running trojanised coding projects during a sham interview, planting malware.

Enforcement

• August 2024: arrest of a Nashville-based laptop-farm facilitator.
• January 2025: indictment of two DPRK nationals and three facilitators, with more than 100 U.S. companies affected.
• June 2025: coordinated action including searches of 29 suspected laptop farms across 16 states and seizure of financial accounts.

Malware & Tooling

BeaverTail (a JavaScript/Node.js downloader-stealer), InvisibleFerret (a Python backdoor with remote control, keylogging and browser/credential theft) and OtterCookie (reported by Cisco Talos, with functions increasingly merged with BeaverTail). The group makes heavy use of generative AI for fake identities and relies on commodity remote-access software for persistence.

MITRE ATT&CK Mapping

Detection & Mitigation

• Harden hiring: rigorous identity verification, live on-camera ID checks, and attention to reluctance to enable a camera and to address/payment mismatches that signal a laptop farm.
• Restrict unauthorised RMM tools, KVM-over-IP and personal VPNs on corporate endpoints; monitor new hires for impossible-travel logins and anomalous data access.
• Tell developers never to run code or npm projects from unsolicited recruiter or interview tasks on production or privileged machines; apply least privilege and offboard fast.