North Korean hackers: half of tech attacks in 2026

The CrowdStrike report: the numbers that redefine the threat

In June 2026, TechCrunch reported CrowdStrike's findings on one of the most underestimated phenomena in global cybersecurity. North Korean actors are responsible for roughly 50% of cyberattacks recorded in the tech sector over the past twelve months. That is an extraordinary share, far higher than the one attributed to other state-sponsored groups.

The geographic reach of the threat has also widened. Campaigns no longer target only US companies. Europe and Asia are explicitly among the priority targets. As a result, the issue now lands squarely on the agenda of Italian SMEs in tech, advanced manufacturing and digital services.

Two attack vectors are mainly documented. The first involves remote IT workers who infiltrate organizations by posing as legitimate freelancers or contractors. The second involves fake recruiters who contact employees at target companies to steal credentials or install malware. So the threat is not only technical: it is social and organizational.

Anatomy of an infiltration: how North Korean groups operate

To understand the scale of the risk, it helps to look at the documented operating techniques. North Korean groups, often classified under the Lazarus Group umbrella and affiliated clusters, combine advanced social engineering with high-level technical skills. In particular, they exploit global remote work platforms to get in as employees or collaborators.

According to analyses by Mandiant (Google Cloud), these operators use false identities built up over time, with credible portfolios and verifiable references. That way, they get past the standard checks of many companies. Once inside, they exfiltrate data, install backdoors or sabotage critical systems.

The fake recruiter tactic is just as relevant. Through LinkedIn and other professional platforms, they approach engineers and developers with attractive job offers. They then send infected files disguised as technical tests or contract documents. Even so, many organizations have yet to update their onboarding and selection protocols to include adequate security checks.

Why Italian SMEs are not immune

Many Italian small and medium-sized businesses share a common belief: "we're too small to be a target." That belief is, in fact, dangerous. North Korean groups don't necessarily look for big, immediate financial payoffs. They often aim to build persistent access, to monetize later or to use as a bridgehead into larger supply chains.

So an Italian tech SME that works with European or American multinationals automatically becomes a potentially weak link. Likewise, companies that hire developers through international platforms such as Upwork, Toptal and LinkedIn are exposed to the infiltration risk documented by CrowdStrike.

What's more, the Italian context has some aggravating factors. The culture of verifying digital identities is still poorly structured. Remote onboarding processes rarely include in-depth checks. And training for non-technical staff on social engineering remains insufficient in most SMEs.

That's why we at SHM Studio believe cybersecurity should be built into a company's overall digital strategy, not treated as a separate topic left entirely to IT.

The strategic view: beyond the technical perimeter

The phenomenon described by CrowdStrike calls for thinking that goes beyond firewalls and antivirus software. According to the Gartner Cybersecurity Framework, the most exposed organizations are those that haven't aligned HR and operational processes with their information security policies. The problem, then, is systemic.

In particular, three areas are critical for Italian SMEs:

• Digital identity management: who enters the organization, with which credentials and at what level of access.
• Remote hiring processes: physical identity verification, structured video onboarding, reference checks through independent channels.
• Security culture: ongoing training for all employees, not just technical teams.

Digital reputation is also often overlooked. A company compromised by a state-sponsored actor suffers damage that goes well beyond data loss: credibility with customers, partners and investors is eroded in ways that are hard to reverse.

Operational implications: what to do in practice

Turning risk awareness into concrete action is the hardest step for many SMEs. Still, there are measures within reach even without an enterprise budget.

First, review your identity verification processes for remote collaborators. This includes mandatory video calls with an ID document, reference checks through direct channels and the use of certified background check tools.

Next, implement the least privilege principle: each collaborator accesses only the resources strictly necessary for their role. That way, any compromise stays contained and doesn't spread across the entire infrastructure.

Phishing and social engineering training should also become regular and mandatory. Attack simulations, or phishing simulations, are effective and relatively inexpensive tools. Finally, adopting Multi-Factor Authentication (MFA) on all critical systems remains the best cost-benefit measure available today.

On the digital presence front, the integrated AI solutions that SHM Studio develops for SMEs also include monitoring and anomaly detection components that can be applied to digital workflows. Similarly, a secure, up-to-date web architecture reduces the exposed attack surface.

The work still open: what's missing from the Italian debate

One key element is still missing from the Italian public debate on cybersecurity: the explicit link between information security and digital competitiveness. The two conversations often happen in separate silos. Yet a company that suffers a significant breach doesn't just lose data: it loses competitive positioning, contracts and trust.

That's why cybersecurity should be part of conversations about digital marketing, SEO and overall digital transformation. It's not a separate topic. It's an enabling condition for any sustainable digital growth strategy.

What's more, the platforms where SMEs build their visibility, from LinkedIn to Google Ads systems, are also documented attack vectors. So whoever manages these platforms needs to be aware of the associated risks.

Finally, strategic copywriting and corporate communication can play an active role in building a security culture: clear messages, understandable policies, effective internal communication. These tools are part of a healthy digital ecosystem.

Outlook for 2027-2028: the threat evolves

The outlook for the next two years is not reassuring. North Korean groups are integrating generative AI tools to make fake identities even more believable. Deepfake videos, synthetic profiles and automated conversations will lower detection barriers even further.

According to analysis from MIT Technology Review, the "infiltrated IT worker" model is set to scale significantly. As a result, SMEs that don't build structured verification processes today will find themselves in an increasingly difficult position in 2027-2028.

That's why investing now in processes, training and secure architectures isn't a cost: it's a way to protect the digital capital you've built over time. If you want to dig deeper into these topics or assess your exposure, you can contact the SHM Studio team for a consultation. More resources and insights are available on the SHM Studio blog.