U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
BLUF
A coordinated U.S.-government and CrowdStrike disruption has degraded FAMOUS CHOLLIMA’s ability to conduct malicious cyber operations.
NEWS
CrowdStrike reported that U.S. authorities disrupted the FAMOUS CHOLLIMA operation with its assistance. The action points to a focused effort against a cybercrime or state-linked abuse network, with cryptocurrency-related fraud and infrastructure abuse as likely themes. The blog post positions CrowdStrike’s threat intelligence and response capabilities as central to identifying and dismantling the operation.
Why I Care
Organizations that rely on digital assets, cryptocurrency services, cloud accounts, or remote access are exposed to similar tactics such as credential theft, social engineering, and infrastructure abuse. The disruption also shows how quickly private-sector telemetry can support law-enforcement action against large-scale cybercrime networks.
Next Steps
Security teams should review CrowdStrike and government advisories for indicators of compromise related to FAMOUS CHOLLIMA, enable phishing-resistant MFA on privileged and crypto-related accounts, restrict remote access and API keys, monitor for anomalous login or transaction activity, and report suspicious incidents to internal incident response or law enforcement within 24 hours.
Source: CrowdStrike Blog ·