{"id":29513,"date":"2026-05-25T23:10:18","date_gmt":"2026-05-25T23:10:18","guid":{"rendered":"https:\/\/www.europesays.com\/korea\/29513\/"},"modified":"2026-05-25T23:10:18","modified_gmt":"2026-05-25T23:10:18","slug":"crowdstrike-north-korea-adversaries-steals-billions-in-digital-assets","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/korea\/29513\/","title":{"rendered":"CrowdStrike: North Korea adversaries steals billions in digital assets"},"content":{"rendered":"

\"ICAS26<\/a>CrowdStrike recently released the CrowdStrike 2026\u00a0Financial Services Threat Landscape Report<\/a>, revealing that DPRK-nexus adversaries stole billions in digital assets in 2025 while industrialising cybercrime with AI-powered deception. Hands-on-keyboard intrusions against financial institutions spiked 43% globally and 48% in North America over the past two years, as adversaries exploited trusted identities and SaaS applications to evade legacy defences. Based on frontline intelligence from CrowdStrike\u00a0Counter Adversary Operations tracking more than 280 named adversaries, the report reveals:<\/p>\n

Digital Asset Theft Hits Record Levels:\u00a0DPRK-nexus actors drove a 51% year-over-year increase in digital asset theft in 2025, stealing a reported $2.02 billion across the sector.\u00a0PRESSURE CHOLLIMA<\/a> conducted the largest financial theft ever reported: $1.46 billion in cryptocurrency through trojan software distributed via a supply chain compromise. GOLDEN CHOLLIMA\u00a0<\/a>used recruitment-themed lures to divert cryptocurrency funds and access cloud environments at fintechs in Southeast Asia and Canada.
\nDPRK Scales Deception with AI:\u00a0DPRK-nexus actors used AI to scale operations against the sector.\u00a0FAMOUS CHOLLIMA<\/a>\u00a0doubled its operations using AI-generated identities to infiltrate cryptocurrency exchanges, fintech platforms, and consumer banks.\u00a0STARDUST CHOLLIMA<\/a>\u00a0tripled its operational tempo, deploying AI-generated recruiter personas and synthetic video conferencing environments to target fintechs across North America, Europe, and Asia.
\nChina-Nexus Espionage Scales Globally:\u00a0China-nexus adversaries posed the most significant intelligence collection threat.\u00a0HOLLOW PANDA<\/a>\u00a0conducted intrusions at financial institutions in the Philippines, Indonesia, and Brazil.\u00a0MURKY PANDA<\/a>\u00a0deployed an operational relay box network across more than 150 endpoints in 36 countries, targeting 340 organisations across more than 30 sectors, with financial services among the most frequently targeted.
\neCrime Pressure on the Sector Intensifies:\u00a0423 financial services organisations appeared on dedicated leak sites marking a 27% increase year-over-year.\u00a0MUTANT SPIDER<\/a>\u00a0drove the highest intrusion volume through vishing campaigns, then sold access to ransomware groups, enabling faster and more scalable attacks. In the first half of 2025,\u00a0SCATTERED SPIDER<\/a> resumed aggressive ransomware operations against insurance entities after a four-month pause.<\/p>\n

\u201cFinancial services organisations face threats from every direction and AI is making each of them harder to stop. The cost to create convincing identities, automate reconnaissance, and accelerate credential theft is near zero,\u201d said Adam Meyers, head of counter adversary operations at CrowdStrike. \u201cAdversaries are using AI to compress the time from initial access to impact, moving through trusted paths faster than legacy defences can respond. To close that gap, defenders have to meet AI with AI \u2013 pairing intelligence with hunting to outpace the adversary.\u201d<\/p>\n

\"APDR_Bulletin_728X90\"<\/a><\/p>\n

For Editorial Inquiries Contact:
Editor Kym Bergmann at\u00a0[email\u00a0protected]<\/a>
For Advertising Inquiries Contact:
Group Sales Director Simon Hadfield at\u00a0[email\u00a0protected]<\/a><\/p>\n

\"leaderboard\"\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"CrowdStrike recently released the CrowdStrike 2026\u00a0Financial Services Threat Landscape Report, revealing that DPRK-nexus adversaries stole billions in digital…\n","protected":false},"author":2,"featured_media":29514,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[12110,31,34],"class_list":["post-29513","post","type-post","status-publish","format-standard","has-post-thumbnail","category-north-korea","tag-crowdstrike","tag-korea","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/29513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=29513"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/29513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/29514"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=29513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=29513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=29513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}