FAMOUS CHOLLIMA is a threat-group name used for DPRK-nexus activity centered on fraudulent employment, social engineering, and insider-style access. Rather than breaking in with malware alone, this tradecraft tries to enter organizations through hiring, identity deception, and legitimate-seeming remote work.
It matters because a hired worker may receive trusted access, company hardware, and access to internal tools before defenders realize the applicant or operator is not who they claimed to be. In real attacks, this can look like fake resumes, stolen identities, proxy workers, laptop farms, or remote management of employer-issued devices. For defenders, the name is a reminder to treat recruiting, onboarding, shipment tracking, and device custody as security controls. Strong identity proofing, address verification, hardware inventory, and behavioral monitoring can help detect this kind of access before it becomes a broader compromise.