United States – October 13, 2026 -- CrowdStrike's Counter Adversary Operations team and the FBI disrupted several U.S.-based laptop farms run by the DPRK-nexus adversary FAMOUS CHOLLIMA in late September 2026. The farms let North Korean operatives pose as remote workers at American companies while hiding their location and identity.
CrowdStrike says dozens of victim organizations were identified across the disrupted clusters. They span aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology and consumer technology. The company describes the targeting as sector-agnostic: any employer offering remote work is a revenue opportunity.
Operatives redirect employer laptops to U.S. farm addresses
CrowdStrike OverWatch has observed operatives filing fraudulent police reports claiming a laptop was stolen, which triggers replacement shipments to farm addresses. They rotate through residential addresses to obscure the final destination. Others claimed last-minute relocations to divert devices mid-shipment. In some cases, operatives secured roles through IT staffing firms, so end-client devices were redirected without the staffing firm's knowledge.
Once a laptop reaches the farm, a facilitator installs hardware and software for remote access. CrowdStrike says the group now tries to hide its use of RMM tools, likely because of heightened operational security after public reporting.
FAMOUS CHOLLIMA has spoofed device hashes since May 2026
Since May 2026, the group has spoofed device hashes, for example making a video capture card appear as a webcam. OverWatch recently saw the same disguised device used across multiple victim organizations, which indicates deliberate reuse of identifiers. Network infrastructure inside the farms shared identifiers across multiple concurrent fake personas, pointing to the scale and coordination of the operation.
CrowdStrike says the farms solve physical, financial and legal problems for the adversary. Without a U.S. presence, operatives could not receive and configure hardware, defeat geolocation-based fraud controls or pass identity verification. The farm and its facilitators provide a physical address, a legal identity and a way to satisfy "know your client" requirements.
CrowdStrike tracked personas and facilitator networks from April 2025 to June 2026
Over that period, the team identified personas, technical indicators and U.S.-based computers used in the scheme. It combined telemetry-driven observations with insights from targeted operations to expose the facilitator networks. CrowdStrike also passes relevant findings from customer network monitoring to law enforcement.
Impact is expected to stay local as the adversary adapts
CrowdStrike calls the action the start of a broader U.S. law enforcement effort to dismantle FAMOUS CHOLLIMA's U.S. infrastructure. It assesses that the disruption will likely slow operations only near the shuttered farms and is unlikely to have long-lasting effects. The adversary will almost certainly keep evolving its methods to evade discovery.
CrowdStrike lists nine hiring red flags for employers
CrowdStrike advises standard background checks and checks for the following indicators:
- Reuse of phone numbers, email addresses, bank accounts or resume text across multiple profiles
- Use of Astrill VPN, AnyDesk, OBS Studio or PiKVM
- Discrepancies between video appearance and identity documents
- Logins from multiple locations in time zones that do not match the reported location
- Mismatched residential and shipping addresses
- Other FAMOUS CHOLLIMA personas listed as job references
- Online connections to known personas, including GitHub followers or LinkedIn connections
- Accounts at banks that allow multiple virtual account numbers and easy conversion to cryptocurrency
- New public profiles on LinkedIn, Twitter, GitHub or freelancer platforms
CrowdStrike notes that lists of known personas and indicators are highly transient.