Insights into Suspected DPRK Workers

North Korean (DPRK) remote IT workers (sometimes referred to as FAMOUS CHOMILLA) continue to pose a prolific threat to global organisations. DPRK-aligned operatives use fake or stolen identities to get hired at companies before sending their wages back to North Korea's regime, stealing data, or planting malware.

Throughout 2026, Huntress has helped a number of organizations validate suspicions that they've hired North Korean nationals posing as legitimate workers.

Detecting DPRK remote workers is inherently challenging for defenders because the workers have been hired by organisations just like a normal employee. They're not compromising legitimate accounts and oftentimes use VPNs and proxy services to mask their true locations. Public reporting has given defenders a better idea on certain indicators and activity associated with these threat actors once they are hired into an organisation; however, it's important to understand their wider modus operandi and how they can be identified during the hiring process to prevent them from gaining employment altogether.

After being alerted by organizations who were already suspicious that they had DPRK workers in their environments, Huntress helped verify that the workers in question weren't legitimate by tracking down several indicators that were tied to previous DPRK-linked incidents. Huntress also identified another case through proactive threat hunting that indicated a DPRK worker was likely present in a different environment.

We are releasing our investigations, correlations, and findings in this blog to help other defenders uncover potential FAMOUS CHOMILLA intrusions. 

Acknowledgements: Special thanks to Dray Agha, Casey Smith, Dave Kleinatland, Matt Kiely, Rich Mozeleski, Michael Tigges, Josh Allman, Anton Ovrutsky, Michael Brown, Harlan Carvey, and Lindsey Welch for their contributions to this investigation and writeup.