FBI & CrowdStrike disrupt North Korean remote worker plot

The FBI and CrowdStrike have disrupted a North Korean remote worker operation linked to the group known as FAMOUS CHOLLIMA. The action led to the seizure of 187 laptops in Texas and two arrests in Ohio.

Authorities said the campaign affected more than 70 US companies and used fraudulent job applications to place operatives inside American businesses as remote IT workers.

Investigators targeted a network of laptop farms that allowed North Korean operatives to appear to be working from within the US. CrowdStrike said the workers used false or stolen identities and had employer-issued devices sent to US addresses controlled by facilitators, who then enabled remote access from abroad.

CrowdStrike, the only private-sector company involved in the operation, provided the FBI with threat intelligence, technical analysis and details of adversary infrastructure. That information helped law enforcement identify the US-based systems and personas supporting the scheme.

How it worked

The model relied on securing jobs at US companies under fabricated identities, then maintaining access to company systems through laptops kept on American soil. Facilitators installed hardware and software on the machines so overseas operatives could log in while appearing to be domestic employees.

Investigators said the group obtained devices by redirecting shipments during onboarding, filing false police reports to trigger replacement deliveries and using staffing firms so laptops could be diverted without the end client knowing. CrowdStrike added that some equipment was configured to disguise technical markers that security teams often track.

The cybersecurity company said it had observed the group spoofing device hashes since May 2026, including making a video capture card appear as a webcam. It also said the same disguised device had been used across multiple victim organisations, suggesting an effort to reuse identifiers while avoiding detection.

The affected companies spanned aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology. According to CrowdStrike, that pattern suggests the group was not tied to one industry and instead pursued any employer willing to hire remote staff.

Broader effort

CrowdStrike said its Counter Adversary Operations team tracked the network between April 2025 and June 2026, identifying personas, technical indicators and US-based computers linked to the fraud. Those findings were shared with law enforcement as part of a broader effort to dismantle the group's US infrastructure.

The operation, known as Operation Lonestar Roundup, is part of a wider US law enforcement push against North Korean IT worker schemes. Investigators have increasingly focused on fake profiles, doctored images and deepfakes in job applications, as well as the movement of wages through bank accounts and cryptocurrency channels.

CrowdStrike said the financial motive was central to the campaign. Salaries paid to workers hired under false pretences were ultimately routed back to North Korea, while the access gained through legitimate employment created opportunities for data theft and further intrusion.

The company also argued that laptop farms solve several practical problems for foreign operatives, including receiving hardware, appearing to be based in the US and using the identities and addresses needed to satisfy hiring and financial checks. Without that domestic layer, it said, the scheme would be harder to sustain.

Even so, CrowdStrike cautioned that the disruption is unlikely to end the activity outright. Shutting down individual laptop farms would probably have only a limited local effect, it said, and the group is likely to adapt its methods and rebuild elsewhere.

For employers, the case highlights growing concern over identity fraud in remote recruitment. CrowdStrike said warning signs include reused phone numbers or email addresses across multiple profiles, mismatches between video appearances and identity documents, inconsistent login locations, differences between residential and shipping addresses, and links to known personas on professional or developer platforms.

"FAMOUS CHOLLIMA has proven itself a persistent and adaptive adversary. But persistence cuts both ways. CrowdStrike's Counter Adversary Operations team will continue to track their evolution, expose their infrastructure, and work with our partners to ensure every intrusion, every fraudulent hire, and every stolen paycheck carries real consequences," CrowdStrike said.