Famous Chollima

Vendor designation overlapping PurpleDelta for North Korean IT worker activity.

Known aliases

Famous Chollina
PurpleDelta

Current stories

securityConfirmed5 publishers

DOJ seizes 187 laptops in raids on more than 40 Texas homes tied to North Korean IT workers

DOJ raided more than 40 Texas residences on September 21-25 and seized 187 laptops and other devices it says North Koreans used in an IT-worker scheme. The FBI says the workers now also hire freelancers in South Asia and West Africa, so US hosts are one intermediary among several.

Publishers:crypto.news cyberscoop.com justice.gov nextgov.com therecord.media

Perspective Coverage

5 publishers

Builder: Builder 7%
Operator: Operator 65%
Investor: Investor 28%

Reality

Evidence74
Adoption: Insufficient
Hype gap+35
Incentives45
Confidence72

securityOne report1 publisher

A ReversingLabs author traces this year's AI agent incidents to package registries

A ReversingLabs author argues in CyberScoop that nearly all of this year's AI agent incidents ran through a package registry, dependency or model file. The cases are named and dated, but "nearly all" is the author's own judgment.

Publishers:cyberscoop.com

Reality

Evidence45
Adoption: Insufficient
Hype gap+30
Incentives80
Confidence55

securityOne report1 publisher

North Korea moves its fraudulent-hire scheme into sales, marketing and medical roles

Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.

Publishers:thehackernews.com

Reality

Evidence50
Adoption: Insufficient
Hype gap+20
Incentives: Insufficient
Confidence50

securityOne report1 publisher

Huntress confirms five DPRK-aligned workers cleared hiring and onboarding in 2026

Recruiting and document review own this intrusion path, because the hire really does the job. Huntress found its five 2026 cases in passport photo metadata and in a PiKVM turning up on a new starter's laptop.

Publishers:securityaffairs.com

Reality

Evidence55
Adoption35
Hype gap+15
Incentives70
Confidence55

securityOne report1 publisher

North Korea's hiring funnel: 60 applications a day, 22 personas, ten jobs landed

Recorded Future says one PurpleDelta cluster applied at more than 1,100 companies and was likely employed at ten or more. The control point is the recruiting funnel, not the SOC.

Publishers:recordedfuture.com

Reality

Evidence64
Adoption55
Hype gap+12
Incentives72
Confidence56