The FBI, working alongside cybersecurity firm CrowdStrike, has disrupted multiple U.S.-based laptop farms used by the North Korean threat group FAMOUS CHOLLIMA, dealing a significant blow to an operation that enabled overseas operatives to secure employment at American organizations under fraudulent identities.
CrowdStrike disclosed the coordinated action on October 13, 2026, describing the takedown as the first phase of a broader campaign targeting the domestic infrastructure and facilitators that support North Korea's illicit remote worker schemes.
The laptop farms functioned as a critical component of the operation, housing corporate-issued devices that were remotely controlled by individuals located outside the United States. By maintaining company laptops on U.S. soil, the group was able to conceal the true locations of workers, circumvent employer verification processes and generate revenue that ultimately benefited the North Korean regime while preserving access to corporate systems.
According to CrowdStrike, affected organizations spanned a wide range of sectors, including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology and consumer technology.
Between April 2025 and June 2026, researchers identified numerous fraudulent identities, infrastructure components and domestically located devices tied to the operation. The investigation focused on uncovering the mechanisms used to facilitate unauthorized employment rather than identifying a new malware strain. CrowdStrike combined technical telemetry with targeted investigative efforts to expose U.S.-based facilitators and subsequently shared its findings with federal authorities.
How the Laptop Farm Network Operated
A major challenge for North Korean operatives seeking employment in the United States is obtaining and using corporate-issued laptops without revealing their true location. Laptop farms helped bridge that gap.
Previous investigations into North Korean employment fraud have shown that local facilitators play a crucial role by providing addresses, receiving equipment shipments and maintaining infrastructure that makes foreign operators appear to be working domestically.
CrowdStrike observed several tactics used to route corporate devices into these facilities. In some cases, individuals filed fraudulent police reports claiming a company laptop had been stolen and then requested a replacement device be mailed to a different address associated with a laptop farm.
Other schemes involved claiming relocation to a new residence and requesting shipment changes, while some operators used multiple residential addresses to obscure the final destination of company hardware. The group also leveraged staffing agencies and IT recruiting firms to obtain positions that provided access to corporate devices and systems without raising immediate suspicion.
Once a laptop arrived at a farm location, facilitators installed hardware and software that enabled remote control from abroad. Although the physical device remained within the United States, overseas operators could access it and perform day-to-day job functions while appearing to employers as legitimate domestic employees.
This arrangement helped the threat actors satisfy location-based security controls, maintain possession of employer-provided equipment and navigate identity verification and payroll procedures.
CrowdStrike noted that facilitators contributed far more than storage space for laptops. They provided physical addresses, identity support and assistance navigating banking and compliance requirements needed to receive employment-related payments. The domestic support network effectively connected hiring, equipment access and financial operations into a single ecosystem.
As a result, disrupting a laptop farm forces operators to rebuild critical parts of their infrastructure even if broader operations continue elsewhere.
Device Spoofing Tactics Increased Operational Stealth
Beginning in May 2026, researchers observed FAMOUS CHOLLIMA employing increasingly sophisticated evasion techniques to reduce the likelihood of detection.
One method involved spoofing device hashes and hardware identifiers. In one example, operators manipulated a video capture device so that it appeared to security systems as a legitimate webcam.
Investigators also discovered the same disguised device identifiers appearing across multiple victim organizations, suggesting the group was recycling hardware fingerprints while attempting to mask activity and blend into normal workplace environments.
Additional analysis revealed that laptop farm infrastructure was being shared among several fraudulent worker personas simultaneously. The reuse of device identifiers, network resources and infrastructure across multiple identities provided investigators with evidence of coordinated activity.
These findings build upon earlier reports of interview fraud tactics in which threat actors used stand-ins, remote desktop software and identity substitution techniques to conceal who was actually attending interviews or performing assigned work.
Legitimate Tools Used for Illicit Purposes
The operation underscores an important challenge for defenders: threat actors frequently rely on legitimate software rather than malware.
CrowdStrike highlighted several commonly used technologies, including Astrill VPN, AnyDesk, OBS Studio and PiKVM, as tools that may warrant additional scrutiny when observed alongside suspicious employment activity.
The presence of these applications does not automatically indicate compromise or malicious intent. However, their use in conjunction with identity discrepancies, unusual shipping requests or inconsistent geolocation data may signal a broader fraud operation deserving closer examination.
Indicators Organizations Should Watch For
To help organizations identify fraudulent remote workers, CrowdStrike recommends enhancing pre-employment screening and ongoing monitoring efforts.
Warning signs may include:
- Reuse of phone numbers across multiple applicants
- Shared email addresses or banking information
- Nearly identical resume language and employment histories
- Duplicate or copied website content associated with candidates
- Inconsistencies between identity documents and video interviews
- Suspicious or unverifiable references
- Recently created online professional profiles
- Login activity that conflicts with an employee's claimed location
- Unusual laptop shipping and replacement requests
Organizations should also continue monitoring remote workers after hiring, as fraudulent activity may only become apparent once devices, payroll systems and corporate resources are in use.
Disruption Likely to Slow, Not Stop, Operations
The latest enforcement action follows previous investigations into North Korean-linked laptop farms, including nationwide searches conducted in 2025. However, CrowdStrike emphasized that the September 2026 disruption represents a separate operation and did not disclose the exact number of facilities raided, arrests made or devices seized.
While the takedown is expected to significantly disrupt local support infrastructure, security researchers caution that FAMOUS CHOLLIMA remains active and capable of adapting its tactics.
As a result, organizations are encouraged to strengthen controls around employee identity verification, device delivery procedures and remote access monitoring. Continuous scrutiny of hiring workflows and remote-worker infrastructure will remain critical as threat actors evolve their methods to maintain access to U.S. businesses and generate revenue through fraudulent employment schemes.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
