Federal agents shut down several laptop farms across the United States in late September 2026, cutting off hardware that North Korean operatives used to hold remote jobs at American companies under false identities. CrowdStrike's Counter Adversary Operations team, which supported the FBI in the operation, disclosed the disruption on October 13.
The farms were part of the infrastructure of Famous Chollima, the DPRK-nexus group behind the long-running fake IT worker scheme. Its operatives get hired under fraudulent or stolen identities, send their wages back to the regime, and keep persistent access to their employers' networks. CrowdStrike describes the action as the beginning of a broader US law enforcement effort to dismantle the group's American infrastructure.
Why North Korea needs an address in America
An operative working from abroad cannot easily receive an employer's laptop. So the scheme relies on US-based facilitators who take delivery of the hardware and install remote access tools on it, letting the worker log in from overseas while appearing to sit at a US address. CrowdStrike says the farms solve three problems the group cannot easily overcome from abroad, physical, financial and legal, by supplying an address, a legal identity, and a way past the "know your client" checks that banks run.
Getting the laptops to a farm takes its own deception. CrowdStrike OverWatch has seen operatives file fraudulent police reports claiming a laptop was stolen so a replacement ships to a farm address, rotate through residential addresses, or announce last-minute relocations to divert a device mid-shipment. Some landed roles through IT staffing firms, which let end-client devices be quietly redirected to a farm without the staffing firm's knowledge.
A capture card dressed up as a webcam
The group is also getting better at hiding its tools. Since May 2026, CrowdStrike says, Famous Chollima has been spoofing device hashes, for example making a video capture card appear to be a webcam. More recently, OverWatch saw the same disguised device used at several separate victim organizations, which CrowdStrike reads as deliberate reuse of device identifiers to evade detection. Network infrastructure inside the farms also shared identifiers across multiple fake personas at once, a sign of the operation's scale.
Victims in the disrupted clusters number in the dozens and span aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology and consumer technology. That breadth fits earlier reporting on the scheme's spread into healthcare and sales roles: any employer offering remote work is a potential revenue source.
Screen new hires for reused details and remote tools
CrowdStrike is candid about the limits. It assesses the takedown will likely slow the group only where farms were shut down and is unlikely to have lasting effect. Because personas and indicators change quickly, it recommends hiring checks that look for:
- Phone numbers, email addresses, bank accounts or resume text reused across several profiles
- Remote computing tools such as Astrill VPN, AnyDesk, OBS Studio or PiKVM
- Differences between a candidate's appearance on video and their identity documents
- Logins from time zones that do not match the stated location, or a shipping address that differs from the home address
- References or online connections to known Famous Chollima personas, and brand-new public profiles
The real value of an operation like this is less the hardware seized than the cost it imposes. Every farm the group has to rebuild is money and time it cannot spend elsewhere, and a reminder that its American footprint is being watched.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.