Threat-actor profile

← Back to main site

Home/ Threat Actors/ Famous Chollima

🇰🇵Famous Chollima

🇰🇵 Famous Chollima is a tracked threat actor in the Clankerusecase corpus. Attributed to KP. Primary motivation: State. We map 9 detection use cases to this actor across 14 MITRE ATT&CK techniques, with 2 threat-intel articles citing them. Active in our corpus from 2026-08-11 to 2026-08-13.

crit 2

View full actor card → All threat actors

9Use cases

2Articles

14Techniques

9IOCs

Known aliases

Famous Chollima

Top techniques

T1021.001 · Remote Desktop Protocol T1190 · Exploit Public-Facing Application T1204.004 · Malicious Copy and Paste

All other tracked techniques

T1047 · Windows Management Instrumentation T1059.001 · PowerShell T1071 · Application Layer Protocol T1078.003 · Local Accounts T1090.003 · Multi-hop Proxy T1133 · External Remote Services T1204.001 · Malicious Link T1219 · Remote Access Tools T1539 · Steal Web Session Cookie T1555.003 · Credentials from Web Browsers T1566.002 · Spearphishing Link

Detection use cases (9)

Corporate sign-in from DPRK IT-worker VPS / AstrillVPN infrastructure (Famous Chollima) Bespoke Managed endpoint network egress to DPRK IT-worker VPS / AstrillVPN IPs Bespoke Infostealer — non-browser process accessing browser cookie/login DBs Internal Phishing-link click correlated to endpoint execution Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal Network connections to article IPs / domains Internal Infostealer — non-browser process accessing browser cookie/login DBs Internal Phishing-link click correlated to endpoint execution Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal

Threat-intel articles (2)

crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring · 2026-08-13

crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers · 2026-08-11

Tracked indicators

IP addresses (9)

104.250.148.58 107.150.38.250 185.152.67.39 192.200.115.226 199.168.112.175 206.217.134.34 45.77.71.42 62.33.223.165 89.187.185.11