FBI Disrupts North Korean Kimsuky Group’s Laptop Farms

Key Takeaways

• The FBI, in collaboration with CrowdStrike, dismantled several U.S.-based “laptop farms” operated by the North Korean threat group FAMOUS CHOLLIMA (also known as Kimsuky).
• These operations involved North Korean operatives posing as legitimate U.S. remote workers to infiltrate American companies, steal intellectual property, and funnel salaries back to the regime.
• Dozens of organizations across critical sectors, including aerospace, energy, finance, healthcare, and defense, were targeted.
• The disruption focused on the physical infrastructure and social engineering tactics rather than a new malware family, highlighting the group’s reliance on identity fraud and remote access tools.

FBI Disrupts North Korean FAMOUS CHOLLIMA Laptop Farms

In a significant cybersecurity operation, the Federal Bureau of Investigation (FBI) successfully dismantled multiple U.S.-based “laptop farms” in late September 2026. These facilities were instrumental to the North Korean threat group FAMOUS CHOLLIMA, also known as Kimsuky, in their sophisticated scheme to infiltrate American businesses by posing as remote employees.

CrowdStrike, a leading cybersecurity firm, publicly revealed its involvement in this joint effort on October 13, characterizing it as the initial phase of a broader campaign targeting the group’s domestic support infrastructure. You can read more about this operation in CrowdStrike’s detailed blog post.

The laptop farms served as physical hubs for company-issued laptops, which North Korean operatives remotely controlled from overseas. This elaborate setup allowed them to obscure their true geographic locations, illicitly collect salaries that ultimately benefited the North Korean regime, and maintain persistent access to the internal systems of their victim organizations.

According to CrowdStrike, the scope of this operation was extensive, impacting dozens of organizations spanning diverse and critical sectors. These included aerospace, energy, finance, healthcare, cybersecurity, defense engineering, government technology, and consumer technology companies. CrowdStrike researchers identified the false identities, technical indicators, and specific U.S. computer systems supporting this illicit activity between April 2025 and June 2026.

The report detailing the disruption highlighted the use of remote access tools and the manipulation of hardware, rather than the discovery of a novel malware family. By meticulously analyzing device activity and conducting targeted investigations, the CrowdStrike team successfully uncovered local facilitators and provided crucial intelligence to the FBI.

The Modus Operandi: Exploiting Trust and Logistics

The success of FAMOUS CHOLLIMA’s operation hinged on exploiting a fundamental logistical challenge: the difficulty of sending a company laptop to an employee hired under a stolen identity in a foreign country without raising suspicion. As previous reports on North Korean identity fraud have indicated, local accomplices in the target country are essential for providing the necessary addresses and equipment to make overseas operatives appear to be legitimate domestic workers.

CrowdStrike observed various tactics employed by the operatives to acquire company laptops. Some filed fraudulent police reports claiming theft, subsequently requesting replacement devices be sent to the farm addresses. Others manipulated delivery routes by claiming sudden relocations or cycled through multiple residential addresses to conceal the final destination of the equipment. In some instances, the group secured positions through IT staffing firms, allowing client devices to reach the farms without the staffing firms’ knowledge. Further details on these methods can be found in CrowdStrike’s analysis.

Upon arrival, a local facilitator would equip the laptop with specialized hardware and software to enable remote control. The physical device remained within the United States, while the actual operator worked from a remote, undisclosed location. This local presence was critical for circumventing location-based security checks, managing employer-issued equipment, and facilitating the identity and financial verifications necessary to receive wages, as explained in CrowdStrike’s findings.

Beyond simply housing laptops, these farms provided a crucial local presence for financial transactions. CrowdStrike noted that facilitators offered physical addresses, legitimate-appearing identities, and a means to navigate banking due diligence requirements. This makes the support network far more than a storage facility; it acts as a critical nexus connecting hiring, access, and payment processes. Dismantling a farm forces the operatives to reconstruct this entire chain, even if the broader group can relocate its efforts.

Device Spoofing Complicates Detection

Since May 2026, CrowdStrike has documented instances of FAMOUS CHOLLIMA operatives actively spoofing device hashes. One notable technique involved disguising a video capture card to appear as a standard webcam. Researchers also observed the same spoofed device identifiers being reused across multiple victim organizations, indicating a deliberate attempt by the operatives to evade detection. This behavior is detailed in CrowdStrike’s report.

Further analysis revealed that these farm networks often shared identifiers across several fabricated worker identities concurrently, providing another clear signal of coordinated illicit activity. These observations align with earlier findings regarding remote interview fraud tactics, where proxies and remote desktop tools were used to conceal the true individuals performing interviews and technical tasks.

For cybersecurity defenders, understanding this distinction is vital: legitimate tools can be repurposed to support illegal operations without themselves being malicious software. CrowdStrike specifically mentioned Astrill VPN, AnyDesk, OBS Studio, and PiKVM as technologies that warrant careful review within context. While their mere presence does not confirm a compromise, their unexplained use in conjunction with inconsistencies in identity or shipping details demands thorough investigation, as advised by CrowdStrike.

CrowdStrike advocates for robust background checks and scrutiny of recurring phone numbers, email addresses, bank accounts, resume phrasing, and website content across different applicant profiles. Additional red flags include discrepancies between identity documents and video appearances, suspicious job references, newly created public profiles, and login activity that contradicts a worker’s stated location. These recommendations are part of CrowdStrike’s guidance for enhanced vigilance.

This recent disruption follows earlier nationwide laptop farm searches reported in June 2025, though these operations should be considered distinct cases. CrowdStrike did not provide specific figures for the September 2026 action, such as the exact number of farms taken offline, arrests made, or devices seized.

Despite this success, CrowdStrike cautioned that the disruption would likely have a localized impact rather than halt the broader operations of FAMOUS CHOLLIMA. The group is expected to remain active and adapt its tactics, underscoring the ongoing necessity for continuous checks on worker identity, device delivery protocols, and remote access monitoring beyond the initial hiring process. Further details on the group’s expected adaptation can be found in CrowdStrike’s assessment.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Enhance Background Checks: Implement rigorous background checks that go beyond standard references. Verify phone numbers, email addresses, bank accounts, and employment history for inconsistencies or reuse across multiple applicants.
• Scrutinize Digital Footprints: Cross-reference resume content and online profiles for identical wording or suspicious similarities. Look for newly created public profiles that lack a substantial history.
• Verify Identity Documents: Pay close attention to discrepancies between submitted identity documents and an applicant’s appearance during video interviews.
• Monitor Device and Access Patterns: Implement robust monitoring for login activity that is inconsistent with an employee’s claimed location or typical work patterns.
• Review Remote Access Tools: Be vigilant for the unauthorized or unexplained use of legitimate remote access tools like Astrill VPN, AnyDesk, OBS Studio, and PiKVM on company devices. While not inherently malicious, their presence may indicate suspicious activity when combined with other red flags.
• Secure Shipping and Logistics: Establish strict protocols for shipping company equipment, especially to new remote employees. Verify addresses independently and track shipments closely to prevent diversions.
• Implement Multi-Factor Authentication (MFA): Enforce MFA across all critical systems to add an extra layer of security, even if credentials are compromised.
• Conduct Regular Security Awareness Training: Educate employees, especially HR and IT staff, on social engineering tactics, identity fraud, and the indicators of compromise associated with sophisticated threat groups.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.