FBI and CrowdStrike Disrupt U.S. Laptop Farms Used by FAMOUS CHOLLIMA
Summary
The FBI and CrowdStrike disrupted U.S. laptop farms used by FAMOUS CHOLLIMA to support fraudulent hires at American companies. The group’s operations continue, and the article lists indicators to help identify suspect job applicants.
Key points
- The disruption targeted U.S. laptop farms that helped operatives pose as remote workers, maintain access to victim organizations, and route illicit wages.
- CrowdStrike identified personas, technical indicators, U.S.-based computers, and facilitator networks between April 2025 and June 2026.
- The farms received employer-issued laptops through onboarding deception, including false theft reports, diverted shipments, and staffing-firm arrangements.
- CrowdStrike observed spoofed device identifiers and repeated use of disguised devices across separate victim organizations.
- The operation involved dozens of victim organizations across sectors including aerospace, energy, finance, healthcare, defense, and government technology.
- CrowdStrike says the disruption is unlikely to have long-lasting effects; FAMOUS CHOLLIMA’s U.S. operations are ongoing.
- Suggested hiring-screening indicators include reused contact or financial details, identity-document discrepancies, unusual remote-computing tools, and mismatched location or shipping information.
Article Details
- Event Type
- U.S. law enforcement disruption of FAMOUS CHOLLIMA laptop farms, conducted with CrowdStrike assistance.
- Impact
- The FBI and CrowdStrike disrupted several U.S.-based laptop farms used to facilitate fraudulent employment, route employer-issued devices, and maintain access to victim organizations. CrowdStrike assesses the disruption is likely to have limited, localized effects and is unlikely to stop FAMOUS CHOLLIMA's ongoing operations.
Threat Actors
Vendors
Tools
AnyDeskUse of remote computing applications such as Astrill VPN, AnyDesk, OBS Studio, or PiKVM Astrill VPNUse of remote computing applications such as Astrill VPN, AnyDesk, OBS Studio, or PiKVM OBS StudioUse of remote computing applications such as Astrill VPN, AnyDesk, OBS Studio, or PiKVM PiKVMUse of remote computing applications such as Astrill VPN, AnyDesk, OBS Studio, or PiKVM
Countries
DPRKmaintained by DPRK-nexus adversary FAMOUS CHOLLIMA to fraudulently employ operatives at American companies while concealing their true location and identity.United StatesIn late September, 2026, CrowdStrike's Counter Adversary Operations team collaborated with the United States Federal Bureau of Investigation (FBI) to disrupt several laptop farms operating across the U.S.
Industries
Aerospaceidentified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, andconsumer technologyfinancial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.defense engineeringspan critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.Energyidentified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumerFinancial Servicesacross the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.government technologyincluding aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.Healthcaredisrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.