US Law Enforcement Disrupts North Korean Remote IT Worker Laptop Farms
The FBI and CrowdStrike have disrupted laptop farms used by North Korean operatives to fraudulently gain remote employment at American companies.
FTMQ Security, written by our newsroom0 views
The CrowdStrike Blog reported that the cybersecurity firm collaborated with the FBI in late September 2026 to disrupt multiple laptop farms across the United States. These facilities were maintained by the North Korea-linked group FAMOUS CHOLLIMA to fraudulently employ operatives at American companies. [1]
According to the CrowdStrike Blog, the laptop farms allowed North Korean operatives to masquerade as legitimate remote workers. This scheme enabled the workers to hide their actual locations, send illicit wages to their regime, and maintain persistent access to the victim organizations. [1]
As FTMQ Security reported earlier, United States authorities previously charged 14 people and seized 187 computers linked to North Korean IT worker schemes. Law enforcement officers executed search warrants at 40 locations in Texas and arrested two United States nationals. [2]
As FTMQ Security reported earlier, the fraudulent IT worker operation affected more than 70 United States companies and generated over $3 million in revenue. [2]
In short
- The FBI and CrowdStrike disrupted laptop farms operated by FAMOUS CHOLLIMA in late September 2026.
- The illicit operation allowed North Korean operatives to pose as remote workers at American companies.
- US authorities previously charged 14 individuals and seized 187 computers tied to the scheme.
- The fraudulent operation impacted over 70 companies and generated more than $3 million.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike AssistanceCrowdStrike Blog, 5d ago (the report this story comes from)
Background
- [2]US authorities target North Korean laptop farms and remote IT worker scheme FTMQ Security, 4d ago
Our newsroom writes these reports with the help of software, from the 2 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- US authorities target North Korean laptop farms and remote IT worker schemeThreat Intelligence, 4d ago
- Chinese hacker uses ARTEX AI and Claude agents against Korean banksTop Stories, 8d ago
More in Nation State Hacking
- Hacker group TAG217 prepped South Korean bank attacks in August2h ago
- FBI arrests former cybersecurity executive on extortion charges1d ago
- Microsoft releases updates for record 1413 vulnerabilities in Patch Tuesday3d ago
- Psiphon Plans to Leave Canada Over Proposed Lawful Access Legislation7d ago
- Japan adopts new active cyber defense strategy for critical infrastructure8d ago
- CrowdStrike joins Anthropic initiative to secure critical infrastructure with artificial intelligence8d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.