North Korean State Actors Infiltrating U.S. Tech Companies as Fake Employees

CrowdStrike's 2024 Threat Hunting Report, published August 2024, documents North Korean operatives obtaining employment at U.S. technology companies using fabricated identities to funnel salaries and system access back to Pyongyang. The group, tracked as Famous Chollima, exploits gaps in hiring verification and background-check processes. Operatives gain legitimate production access—source repositories, cloud infrastructure, customer data—that generates no anomalous telemetry during normal work.