Fake Remote Workers, Real Laptops: US Disrupts North Korea-Linked Laptop Farms

In late September 2026, CrowdStrike's Counter Adversary Operations team worked with the US Federal Bureau of Investigation (FBI) to disrupt several laptop farms across the United States. The farms were maintained by FAMOUS CHOLLIMA, an adversary linked to North Korea. They allowed operatives to pose as legitimate remote workers, hide their true location and identity, and send illicit wages back to the regime while keeping persistent access to victim organisations. CrowdStrike says this is the start of a broader US law enforcement effort to dismantle the group's US infrastructure, and that it intends to remain part of that effort.

The scheme depends on getting hold of employer-issued laptops. Because the operatives are hired under fraudulent or stolen identities, shipping devices overseas is not easy. CrowdStrike OverWatch has seen operatives file fraudulent police reports claiming a laptop was stolen, which triggers a replacement shipped to a farm address. They rotate through residential addresses to obscure the final destination. Others claimed last-minute relocations to divert devices mid-shipment. In some cases, operatives won roles through IT staffing firms, so client devices were quietly redirected without the staffing firm knowing.

Once a laptop reaches the farm, a facilitator installs hardware and software that enables remote access. CrowdStrike OverWatch has seen the group try to hide its use of remote monitoring and management (RMM) tools, likely because of greater operational security after public reporting on its activity.