FAMOUS CHOLLIMA is a North Korea-nexus threat actor CrowdStrike began naming in August 2024, assessing it as financially motivated and active since at least 2018. CrowdStrike documented operatives fraudulently obtaining remote IT jobs at over 100 mostly US-based technology companies by posing as US residents, then using employee access to install remote-monitoring tools such as RustDesk, AnyDesk and Chrome Remote Desktop and attempt data exfiltration via Git, SharePoint and OneDrive, funneling salaries to North Korea. Other reporting links the group to the Contagious Interview campaign, in which fake recruiters lure software developers, particularly those with cryptocurrency or blockchain experience, into fake coding tests delivering the BeaverTail downloader and the InvisibleFerret backdoor to steal browser credentials and cryptocurrency wallet data. Later reporting describes the group, assessed as a Lazarus subgroup, evolving its tooling to include the GolangGhost and PylangGhost remote access trojans and merged BeaverTail and OtterCookie variants with keylogging and screenshot capture, while CrowdStrike's 2026 reporting states its operations doubled year over year in 2025, increasingly using AI-generated identities to target cryptocurrency exchanges, fintech platforms and consumer banks.