FBI Disrupts North Korean Famous Chollima Laptop Farms Used to Infiltrate U.S. Companies

The FBI disrupted several U.S. laptop farms used by North Korean threat group FAMOUS CHOLLIMA in late September 2026, cutting off infrastructure that helped fake remote workers enter American companies.

CrowdStrike disclosed the joint operation on October 13, describing it as the start of a wider effort against the group’s domestic support network.

The farms housed company laptops that overseas operatives controlled remotely while posing as U.S. employees. This setup helped them hide their locations, collect salaries for North Korea’s regime, and keep access to employer systems.

CrowdStrike said dozens of affected organizations operated across aerospace, energy, finance, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.

CrowdStrike researchers identified false identities, technical indicators, and U.S. computers supporting the scheme between April 2025 and June 2026.

Their report on the disruption describes remote access tools and hardware abuse, not a newly identified malware family. The team combined device activity with targeted investigations to uncover local facilitators and share findings with the FBI.

FBI Disrupts North Korean Famous Chollima Laptop Farms Used

The operation depended on a simple gap: a worker hired under a stolen identity could not easily receive a company laptop abroad without raising questions.

As earlier reporting on North Korean identity fraud explains, local helpers provide the addresses and equipment needed to make overseas workers appear domestic.

CrowdStrike observed operatives filing false police reports claiming laptops had been stolen, then requesting replacements at farm addresses.

Others claimed sudden moves to redirect deliveries or rotated through residential addresses to hide the final destination. Some obtained jobs through IT staffing firms, allowing client devices to reach farms without those firms knowing.

Once a laptop arrived, a facilitator added hardware and software for remote control. The physical device stayed in the United States while its operator worked elsewhere.

This local presence helped the group pass location checks, handle employer equipment, and support identity and financial checks needed to receive wages.

The farms also supplied a trusted local presence for financial checks. CrowdStrike described facilitators as providing a physical address, a legal identity, and a route through bank due diligence requirements.

That makes the support network more than a place to store laptops: it connects hiring, access, and payment. Taking a farm offline forces operators to rebuild that chain, even when the wider group can move elsewhere.

Device Spoofing Complicates Detection

Since May 2026, CrowdStrike has observed FAMOUS CHOLLIMA spoofing device hashes, including making a video capture card appear to be a webcam.

Researchers also saw the same disguised device across separate victim organizations, suggesting operators reused device identifiers while trying to avoid detection.

Farm networks shared identifiers across several fake worker identities at the same time, offering another clue to coordinated activity.

The findings complement earlier coverage of remote interview fraud tactics, where stand-ins and remote desktop tools helped hide who was actually completing interviews and technical work.

The distinction matters for defenders: a legitimate tool can support an illegal operation without being malware. CrowdStrike names Astrill VPN, AnyDesk, OBS Studio, and PiKVM as technologies to review in context.

Their presence alone does not prove compromise, but unexplained use alongside identity or shipping inconsistencies deserves investigation.

CrowdStrike recommends standard background checks and reviews for reused phone numbers, email addresses, bank accounts, resume wording, and website content across profiles.

Other warning signs include differences between identity documents and video appearances, suspicious job references, new public profiles, and login activity inconsistent with a worker’s claimed location.

The latest disruption follows earlier nationwide laptop farm searches reported in June 2025, but the operations should not be treated as the same case. CrowdStrike did not disclose an exact farm count, arrest total, or seized device count for the September 2026 action.

CrowdStrike warned that the disruption will likely have a limited local effect rather than stop the wider operation.

FAMOUS CHOLLIMA remains active and is expected to adapt, making continued checks on worker identity, device delivery, and remote access important beyond the initial hiring process.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post FBI Disrupts North Korean Famous Chollima Laptop Farms Used to Infiltrate U.S. Companies appeared first on Cyber Security News.