North Korea-linked hackers pose biggest global threat, accounting for over half of state-backed attacks

North Korea-linked hacking organizations pose the most significant global threat, responsible for more than half of all state-backed cyberattacks worldwide, a U.S. cybersecurity firm reported. CrowdStrike, in its '2026 Threat Hunting Report,' identified 'Famous Chollima,' a North Korean-affiliated hacking group, as the most dangerous entity for its cyber activities over the past year.

According to the report, Famous Chollima accounted for 55% of all state-sponsored hacking incidents and 44% of all security breaches within the technology sector between July 1, 2023, and June 30, 2024. The group has been actively conducting large-scale infiltration operations targeting technology companies across North America, Europe, and Asia. This involves North Korean IT personnel posing as citizens of other countries to gain employment at tech firms, from where they conduct their hacking activities internally.

The report also highlighted that Famous Chollima is exploiting vulnerabilities in artificial intelligence (AI) tools. As companies adopt AI for operational efficiency, new security loopholes emerge that are not yet fully vetted. North Korean hacking groups are reportedly already targeting these weaknesses. Another North Korean-linked group, 'Stardust Chollima,' has been focusing its attacks on fintech companies and virtual asset exchanges.

This surge in sophisticated cyber operations underscores the evolving tactics of state-sponsored hacking groups, particularly those linked to North Korea. Their ability to adapt, infiltrate, and exploit emerging technologies like AI presents a growing challenge for global cybersecurity efforts.