Western companies in healthcare, IT, sales, and marketing

Date (as written): 01/09/2026
Year: 2026
Country: AU, MULTIPLE
Actors (as written): FAMOUS CHOLLIMA
Actor pages: FAMOUS CHOLLIMA
Tags (as written): Attack: Impersonation; Target Class: K - Financial and insurance activities Q - Human health and social work activities; Attack Class: Cyber Espionage; Initial Access: T1078 - Valid Accounts

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Western companies in healthcare, IT, sales, and marketing · 01/09/2026

North Korea's FAMOUS CHOLLIMA operatives obtain legitimate employment at Western companies using fraudulent identities and PiKVM devices, diverting salaries to DPRK while collecting intelligence from inside company systems. [Date Occurred: During 2026; Date Discovered: During 2026]

https://www.hackmageddon.com/2026/09/29/september-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/1sn0d9OIEXxw2D2hmWK69emA2dTuDXr0FeJba33JQUc4/export?format=csv&gid=0

https://securityaffairs.com/198227/apt/north-korea-linked-it-workers-are-getting-hired-inside-western-companies.html

Suggest a correction on GitHub