Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

• Huntress investigated multiple customer incidents tied to DPRK remote workers
• Activity linked to the Famous Chollima cluster
• Report lists indicators to detect and prevent infiltration
• Scheme relies on fake identities to gain remote employment