The Federal Bureau of Investigation (FBI) has successfully dismantled multiple laptop farms in the United States operated by the North Korean threat group known as FAMOUS CHOLLIMA. The operation, conducted in late September 2026, aimed to cut off a major source of infiltration used by the group to impersonate remote workers in American companies.
Details of the Joint Operation
On October 13, cybersecurity firm CrowdStrike revealed details of the joint operation, marking a significant step in countering the group’s domestic support network. These laptop farms allowed North Korean operatives to remotely control company laptops, posing as U.S.-based employees. This arrangement enabled them to conceal their true locations, siphon salaries to the North Korean regime, and maintain access to sensitive employer systems.
According to CrowdStrike, the compromised organizations spanned various sectors, including aerospace, energy, finance, healthcare, cybersecurity, and government technology. Between April 2025 and June 2026, researchers identified false identities and technical indicators tied to U.S. computers supporting this scheme.
How the Scheme Operated
The operation relied on exploiting a critical vulnerability: foreign operatives, using stolen identities, could not easily receive company laptops abroad without raising suspicion. Local accomplices in the U.S. provided addresses and equipment necessary for the operatives to appear as domestic employees.
In some instances, operatives filed false police reports to claim laptops were stolen, thereby requesting replacements to be sent to farm addresses. Others used IT staffing firms to channel devices to these farms, unbeknownst to the firms. Once a laptop was received, facilitators equipped it with hardware and software for remote control, allowing operatives to work from abroad while keeping the physical device in the U.S.
Challenges in Detecting the Threat
Since May 2026, CrowdStrike has observed FAMOUS CHOLLIMA employing device spoofing, such as making a capture card appear as a webcam, to avoid detection. These spoofed devices were shared across multiple fake identities, indicating coordinated activity.
The use of legitimate tools like Astrill VPN, AnyDesk, OBS Studio, and PiKVM, while not inherently malicious, can facilitate illegal operations. CrowdStrike advises reviewing these technologies in the context of identity or shipping inconsistencies to detect potential threats.
CrowdStrike also recommends thorough background checks and vigilance for reused contact details, suspicious job references, or login activity that does not match a worker’s claimed location. Despite the disruption, CrowdStrike warns that FAMOUS CHOLLIMA remains active and adaptable, necessitating ongoing scrutiny of worker identity, device delivery, and remote access protocols.
This recent disruption follows other searches conducted in June 2025, though CrowdStrike cautions against conflating the two operations. The September 2026 action did not disclose specific numbers of farms disrupted, arrests made, or devices seized, but the effort is part of a broader strategy to combat North Korean cyber threats.
