U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance

In late September, 2026, CrowdStrike's Counter Adversary Operations team collaborated with the United States Federal Bureau of Investigation (FBI) to disrupt several laptop farms operating across the U.S. maintained by DPRK-nexus adversary FAMOUS CHOLLIMA to fraudulently employ operatives at American companies while concealing their true location and identity.

These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations. Working alongside the FBI, CrowdStrike’s threat intelligence into the adversary and their operations, and technical analysis helped make these disruptions possible.

This operation marks the beginning of a broader U.S. law enforcement effort to dismantle FAMOUS CHOLLIMA's U.S. infrastructure. CrowdStrike's Counter Adversary Operations team intends to remain an integral part of that effort.

FAMOUS CHOLLIMA’s Reliance on Laptop Farms

To conduct their employment fraud operations, FAMOUS CHOLLIMA operatives must first find a way to gain access to their employer-issued laptops. Because the adversary gains employment under fraudulent or stolen identities, shipping these laptops to their base of operations is not easily accomplished. 

Instead, FAMOUS CHOLLIMA operatives employ a range of deception techniques during onboarding to direct their employer-provided hardware to laptop farm addresses. CrowdStrike OverWatch has observed operatives filing fraudulent police reports claiming a laptop was stolen to trigger replacement shipments to farm addresses; they rotate through residential addresses to obscure the final destination. Others claimed last-minute relocations to divert devices mid-shipment. In some cases, operatives secured roles through IT staffing firms, which allowed end-client devices to be quietly redirected to farm infrastructure without the staffing firm's knowledge.

Once at the farm, a facilitator installs a combination of hardware and software onto these laptops to enable remote access. CrowdStrike Overwatch has seen FAMOUS CHOLLIMA attempt to hide their use of these RMM tools, likely due to increased operational security following public reporting on their activity. 

Since May 2026, FAMOUS CHOLLIMA has begun spoofing device hashes; for example, making a video capture card appear as a webcam. Most recently, CrowdStrike OverWatch observed FAMOUS CHOLLIMA using the same disguised device across multiple separate victim organizations, suggesting operatives are deliberately reusing device identifiers to evade detection. This demonstrates clear awareness of the indicators defenders are tracking. Network infrastructure within laptop farms was found sharing identifiers across multiple concurrent fake personas, a sign of the operation's scale and coordination.

Laptop farms are vital to FAMOUS CHOLLIMA's revenue-generating operations because they solve three problems the adversary cannot easily overcome from abroad: physical, financial, and legal. 

Without a U.S.-based presence, FAMOUS CHOLLIMA’s operatives would be unable to receive and configure employer-provided hardware, defeat geolocation-based fraud controls, or navigate the identity verification systems that gatekeep legitimate employment. The laptop farm and its facilitators serve as a rented U.S. footprint: a physical address, a legal identity, and a mechanism to satisfy “know your client” regulations, which are part of financial institutions’ due diligence requirements. 

While disrupting a laptop farm will likely only yield a limited impact on FAMOUS CHOLLIMA, centered mostly on the geolocation of the takedown, these operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements.

CrowdStrike Counter Adversary Operations' Role in Identifying FAMOUS CHOLLIMA's Laptop Farm Infrastructure

Between April 2025 and June 2026, CrowdStrike's Counter Adversary Operations team identified personas, technical indicators, and U.S.-based computers used by the adversary to enable their fraudulent employment operations. By combining telemetry-driven observations with insights derived from targeted operations conducted by CrowdStrike Counter Adversary Operations, the team was able to uncover key personas and expose U.S.-based facilitator networks supporting the scheme. 

CrowdStrike’s Counter Adversary Operations team continues to monitor customer networks to protect them from FAMOUS CHOLLIMA infiltration efforts and passes relevant information to law enforcement to help counter the adversary from multiple directions. 

The dozens of victim organizations identified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology. This breadth reflects FAMOUS CHOLLIMA's sector-agnostic targeting posture, in which any organization offering remote employment provides an opportunity for revenue generation.

Conclusion

FAMOUS CHOLLIMA’s U.S. operations are ongoing. This disruption will likely slow FAMOUS CHOLLIMA's operations only in the immediate areas where the laptop farms were shut down and is unlikely to create long-lasting effects. The adversary will almost certainly continue to evolve their methods to evade law enforcement discovery and disruption.

This action by law enforcement sends a clear message to FAMOUS CHOLLIMA: Their infrastructure is visible, their movements are being tracked, and the cost of operating is rising.

Visibility alone is not enough. Disruption operations like this one are a critical part of raising that cost. They force the adversary to rebuild, relocate, and reinvest resources that would otherwise fund the regime's priorities. Every farm taken down is time and money FAMOUS CHOLLIMA cannot get back.

To that end, CrowdStrike’s Counter Adversary Operations team remains deeply committed to its partnership with law enforcement. FAMOUS CHOLLIMA has proven itself a persistent and adaptive adversary. But persistence cuts both ways. CrowdStrike’s Counter Adversary Operations team will continue to track their evolution, expose their infrastructure, and work with our partners to ensure every intrusion, every fraudulent hire, and every stolen paycheck carries real consequences.

Recommendations

While maintaining a list of known FAMOUS CHOLLIMA personas and indicators is useful, these are highly transient. When assessing potential hires’ proof of identity, run a standard background check and look for the following indicators:

• Reuse of phone numbers, email addresses, bank accounts, or content such as resume text or website copy across multiple online profiles
• Use of remote computing applications such as Astrill VPN, AnyDesk, OBS Studio, or PiKVM 
• Discrepancies between appearance on video and on identity documents
• Logins to multiple locations during time zones that do not match the reported location
• Discrepancies between the residential address and shipping address
• Use of other FAMOUS CHOLLIMA personas as job references
• Online connections to FAMOUS CHOLLIMA personas, including GitHub followers or LinkedIn connections
• Accounts at any bank that allows account holders to create multiple virtual account numbers and easily convert funds to cryptocurrency
• New public profiles on LinkedIn, Twitter, GitHub, or freelancer platforms

Additional Resources

• Learn more about CrowdStrike Counter Adversary Operations threat intelligence and threat hunting, or request a demo.
• Tune in to the Adversary Universe podcast, where CrowdStrike reveals the threat actors behind the latest cyberattacks.