U.S. Government Disrupts FAMOUS CHOLLIMA Cyber Operation With CrowdStrike Assistance

The U.S. government disrupted the operations of the threat group known as FAMOUS CHOLLIMA, according to first-hand research published by CrowdStrike on October 13, 2026. CrowdStrike provided assistance to federal authorities to help execute this disruption against the cyber actor.

CrowdStrike researchers published the details of the disruption on its website, highlighting the collaboration between security vendors and law enforcement. The publication confirms that CrowdStrike played a supportive role in the effort to interfere with the group's ongoing activities.

Operational Context

The announcement appears in CrowdStrike's Threat Hunting & Intel category, indicating the focus on active threat intelligence and response. The company released this information alongside other updates, including news about AI-driven threats targeting South Korean finance.

The timing of the disclosure coincides with other significant security news, such as reports on October 13 regarding 1,413 CVEs in Patch Tuesday updates. However, the FAMOUS CHOLLIMA disruption stands as a distinct operational success involving direct coordination with U.S. authorities.

Affected Entities and Attribution

The source material identifies the threat actor as FAMOUS CHOLLIMA but does not specify the sectors targeted or the specific infrastructure compromised in this instance. The report also does not attribute the group to any specific nation-state or geographic origin.

Readers should note that while the operation was disrupted, the source does not claim the group was permanently dismantled or that all its infrastructure was removed. The language used is strictly "disrupted," which implies interference rather than total eradication of the threat.

What should you do?

Security teams should monitor for any indicators of compromise associated with FAMOUS CHOLLIMA as detailed in subsequent threat intelligence reports. Organizations should verify their endpoint protection capabilities are up to date to defend against similar intrusion techniques.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: FAMOUS CHOLLIMA

• Review recent threat intelligence feeds for any new Indicators of Compromise (IOCs) linked to FAMOUS CHOLLIMA or related activity.
• Ensure endpoint detection and response (EDR) solutions are actively monitoring for suspicious process executions and lateral movement.
• Validate that identity protection measures are in place to detect unauthorized access attempts that may follow initial compromise.
• Coordinate with internal incident response teams to establish clear protocols for engaging with external partners during active threats.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did CrowdStrike say the FAMOUS CHOLLIMA group was completely eliminated?

No, the source states the operation was disrupted, not that the group was dismantled or eliminated.

Is FAMOUS CHOLLIMA linked to North Korea according to this report?

The provided source material does not mention North Korea or any specific national attribution for the group.

When was this disruption reported by CrowdStrike?

CrowdStrike published the details of the disruption on October 13, 2026.