North Korea-linked IT Workers Are Getting Hired Inside Western Companies
Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.
Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.
- Five confirmed DPRK-linked hires in 2026 across IT, sales and healthcare roles
- Fake Chinese passports and electricity bills with identical typos exposed a healthcare case
- One worker connected a PiKVM travel-router setup signaling a laptop farm
- Stolen real identity with swapped face photo used for I-9 verification
- Huntress recommends correlating PiKVM/Guacamole devices, VPNs and unusual hours
- Vendors
- Huntress
- Threat actors
- FAMOUS CHOLLIMA
- Organizations
- North Korea
- Countries
- North KoreaAustralia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ip.me | ’t belong to the face on the video call. “The user accessed ip[.]me directly to determine their public-facing IP address just |
From the original article
4 min read at securityaffairs.com
Huntress found five DPRK-linked workers hired in 2026 using fake identities, remote-access setups and proxy tools to infiltrate legitimate companies. Companies keep accidentally hiring North Korea-linked individuals as remote workers, and Huntress just published the receipts.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.