U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance

CrowdStrike and the FBI collaborated in late September 2026 to disrupt laptop farms operated by the DPRK-nexus adversary FAMOUS CHOLLIMA, which were used to fraudulently employ operatives in American companies while hiding their true locations. This action began a broader law enforcement effort to dismantle FAMOUS CHOLLIMA's U.S. infrastructure, with CrowdStrike remaining involved. The operation targeted numerous victim organizations across sectors including aerospace, energy, finance, healthcare, and technology.
The disruption focused on how FAMOUS CHOLLIMA obtained and utilized employer-issued laptops. Operatives used deception during onboarding, such as filing fraudulent police reports for stolen devices or claiming last-minute relocations, to direct hardware to the laptop farms. Once at the farm, facilitators installed remote access tools. The adversary also engaged in activity like spoofing device hashes to evade detection, reusing disguised devices across different victim organizations.
Laptop farms provided FAMOUS CHOLLIMA with a U.S. footprint by supplying physical addresses and legal identities necessary to bypass geolocation controls and satisfy "know your client" regulations for employment. While the immediate impact of shutting down specific farms is limited, the operation signals to the adversary that their infrastructure is visible and tracked.

* CrowdStrike's Counter Adversary Operations team collaborated with the FBI in late September 2026.
* The collaboration aimed to disrupt laptop farms operated by DPRK-nexus adversary FAMOUS CHOLLIMA.
* The objective was to stop operatives from fraudulently employing individuals at American companies while concealing their location and identity.
* Laptop farms allowed FAMOUS CHOLLIMA operatives to siphon wages and maintain access to victim organizations.
* Operatives used deception, such as filing fraudulent police reports or claiming relocations, to direct hardware to farm addresses.
* Facilitators installed hardware and software on laptops to enable remote access.
* Since May 2026, FAMOUS CHOLLIMA spoofed device hashes, for example, making a video capture card appear as a webcam.
* FAMOUS CHOLLIMA reused disguised devices across multiple victim organizations.
* Network infrastructure within laptop farms shared identifiers across concurrent fake personas.
* The disrupted victim organizations spanned aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology sectors.
* The operation was based on observations and technical analysis by CrowdStrike's threat intelligence.

The narrative centers on the infrastructure required to conduct transnational employment fraud, highlighting that physical presence—the laptop farm—serves a functional role beyond mere logistics; it acts as a rented U.S. footprint that addresses physical, financial, and legal constraints faced by external operatives. The pattern observed is the adversary's strategic adoption of decentralized, proxy infrastructure (laptop farms) to bridge the gap between remote employment demands and real-world operational needs, effectively weaponizing legitimate administrative procedures like IT staffing firms for obfuscation.
The repeated focus on device spoofing and identifier reuse demonstrates an adaptation strategy where the adversary must constantly evolve methods simply to maintain a baseline level of evasion against established threat intelligence indicators. The implication is that visibility alone is insufficient; sustained pressure requires actions that increase the operational cost—forcing relocation and reinvestment rather than yielding permanent destruction.
The challenge for resilience lies in understanding how adversaries leverage legitimate systems (like employment channels) as vectors for illicit gain. If infrastructure disruption only yields temporary results, the focus shifts from physical takedowns to identifying and constraining the systemic dependencies that allow these infrastructures to regenerate. What mechanisms exist for ensuring that future efforts target the foundational dependencies rather than just the ephemeral operational nodes?