In late September 2026, CrowdStrike’s Counter Adversary Operations team collaborated with the FBI to disrupt a network of laptop farms operated by the North Korean adversary known as FAMOUS CHOLLIMA. These operations facilitated fraudulent employment practices, allowing operatives to pose as legitimate remote workers while siphoning illicit wages back to North Korea. This disruption is part of a broader U.S. law enforcement initiative aimed at dismantling FAMOUS CHOLLIMA’s infrastructure within the United States.
The Mechanism Behind FAMOUS CHOLLIMA’s Operations
FAMOUS CHOLLIMA’s laptop farms are critical to their operational strategy, enabling them to bypass various barriers associated with remote employment. The adversary employs deceptive tactics to gain access to employer-issued laptops, which are essential for their fraudulent activities. Instead of shipping these devices directly to North Korea, operatives use a range of techniques to redirect shipments to laptop farm addresses within the U.S.
For instance, operatives have been observed filing fraudulent police reports claiming that laptops were stolen, prompting replacement shipments to be sent to the farms. They also manipulate shipping logistics by claiming last-minute relocations or securing roles through IT staffing firms, allowing them to divert devices without the staffing firm’s knowledge. Once the laptops arrive at the farms, facilitators install remote access tools to maintain control over the devices.
Recent observations by CrowdStrike’s OverWatch team indicate that FAMOUS CHOLLIMA has begun spoofing device identifiers, such as making a video capture card appear as a webcam. This tactic suggests a heightened awareness of detection mechanisms employed by defenders. The network infrastructure within these laptop farms has also been found to share identifiers across multiple fake personas, indicating a high level of coordination and scale in their operations.
Impact of the Disruption
While the disruption of these laptop farms may not completely dismantle FAMOUS CHOLLIMA’s operations, it sends a strong message regarding the visibility and tracking of their activities. The operation highlights the ongoing efforts by U.S. law enforcement and CrowdStrike to monitor and counteract the adversary’s tactics. The breadth of victim organizations affected spans critical sectors, including aerospace, energy, financial services, and healthcare, underscoring the adversary’s sector-agnostic targeting approach.
Despite the immediate impact of shutting down these farms, FAMOUS CHOLLIMA is likely to adapt and evolve its methods to evade detection. The disruption serves as a reminder that while visibility is crucial, proactive measures are necessary to raise the operational costs for adversaries. Each farm taken down represents a significant investment of time and resources that FAMOUS CHOLLIMA cannot reclaim.
CrowdStrike’s Ongoing Role
CrowdStrike’s Counter Adversary Operations team has played a pivotal role in identifying the infrastructure supporting FAMOUS CHOLLIMA’s fraudulent employment schemes. By leveraging telemetry-driven observations and targeted operations, the team has uncovered key personas and U.S.-based facilitator networks. This ongoing monitoring not only protects customer networks from infiltration but also aids law enforcement in countering the adversary’s activities.
The collaboration between CrowdStrike and the FBI exemplifies a multi-faceted approach to cybersecurity, where intelligence sharing and operational disruption work hand in hand. As FAMOUS CHOLLIMA continues to adapt, CrowdStrike remains committed to tracking their evolution and exposing their infrastructure, ensuring that every intrusion and fraudulent hire incurs real consequences.
For organizations looking to safeguard against similar threats, maintaining vigilance in hiring practices is essential. Background checks should include scrutiny for indicators such as the reuse of personal information across profiles, discrepancies in identity documentation, and unusual login patterns. These proactive measures can help mitigate the risks posed by adversaries like FAMOUS CHOLLIMA.
As the landscape of cyber threats continues to evolve, the partnership between cybersecurity firms and law enforcement will be crucial in addressing the challenges posed by sophisticated adversaries. The disruption of FAMOUS CHOLLIMA’s laptop farms is a significant step in this ongoing battle, but it is clear that the adversary will continue to seek new methods to exploit vulnerabilities in the system.
For further insights into the operational tactics of FAMOUS CHOLLIMA and the implications for cybersecurity, refer to the detailed analysis provided by CrowdStrike here.
