U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance

CrowdStrike reports that its Counter Adversary Operations team collaborated with the FBI in late September 2026 to disrupt U.S.-based laptop farms used by the DPRK-linked group FAMOUS CHOLLIMA to place operatives in remote jobs under fraudulent identities. According to the company, the farms received and configured employer-issued laptops, enabled remote access through hardware and software tools, and helped operatives evade location, identity-verification, and financial controls while sending wages to North Korea. CrowdStrike said it identified relevant personas, technical indicators, and facilitator networks from April 2025 through June 2026, with affected organizations spanning sectors including aerospace, energy, finance, healthcare, defense, government technology, and cybersecurity. The company cautioned that the disruption would probably have localized and temporary effects because the group is adaptive, while advising employers to scrutinize identity inconsistencies, reused contact or banking details, suspicious remote-access tools, conflicting login locations, and questionable references during hiring.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.