North Korean IT Worker Scheme Targets Dozens of Organizations Across Critical U.S. Sectors

The FBI and CrowdStrike have disrupted U.S. laptop farms supporting FAMOUS CHOLLIMA, a North Korean operation that places fraudulent remote IT workers inside American companies.

The infrastructure enabled workers abroad to collect salaries, conceal their locations, and maintain access to corporate environments.

Victims identified by CrowdStrike spanned aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology.

The disruption formed part of Operation Lonestar Roundup. Between September 21 and 25, 2026, the FBI conducted searches and other enforcement actions at more than 40 Texas residences suspected of hosting laptop farms.

Investigators seized approximately 187 laptops and keyboard, video, and mouse devices, according to the Justice Department’s October 13 announcement.

FAMOUS CHOLLIMA’s operation is physical: employer-issued laptops cannot easily be shipped directly to overseas operatives without exposing fraudulent identities or locations.

U.S.-based facilitators bridge that gap by receiving devices, configuring remote connectivity, and presenting an apparently domestic working environment.

CrowdStrike described several methods for redirecting hardware. Operatives allegedly filed fraudulent police reports claiming laptops were stolen, prompting replacement shipments to farm addresses.

Others cited last-minute relocations or rotated residential addresses to obscure delivery destinations.

Staffing arrangements also allowed end-client equipment to reach farm infrastructure without the staffing firm’s knowledge.

Once delivered, laptops receive hardware and software that enable overseas operators to work remotely.

This arrangement gives fraudulent hires access through genuine corporate endpoints rather than requiring an initial exploit.

The Justice Department said facilitators also installed remote-access software and transferred earnings to DPRK-controlled accounts.

North Korean IT Worker Scheme

According to CrowdStrike, FAMOUS CHOLLIMA began spoofing device hashes in May 2026, including disguising video capture cards as webcams.

CrowdStrike OverWatch subsequently observed the same disguised device across separate victim organizations, suggesting deliberate identifier reuse as the adversary adapted to defender scrutiny.

Shared network infrastructure identifiers across concurrent fake personas provided another indication of coordinated operations.

These overlaps matter because individually plausible employees can become suspicious when their endpoint artifacts, connectivity patterns, or hardware identifiers converge across unrelated employers.

Between April 2025 and June 2026, CrowdStrike’s Counter Adversary Operations team combined telemetry with targeted investigative work to identify fraudulent personas, technical indicators, U.S.-based computers, and facilitator networks.

A related Ohio indictment announced October 13 described an alleged scheme affecting more than 70 U.S. employers and generating approximately $3 million.

Authorities arrested Americans Michael James Bostelle and Juan Cecilio Pena Carrillo. Those figures concern the indictment’s scheme, not necessarily CrowdStrike’s disrupted victim clusters; the defendants remain presumed innocent.

The Justice Department also published email indicators associated with the activity and highlighted an FBI advisory addressing evolving facilitator recruitment.

Its announcement connects the operation to the DPRK RevGen: Domestic Enabler Initiative, which targets North Korean revenue generation and American intermediaries.

The takedowns remove working infrastructure, but CrowdStrike assesses their impact as geographically limited rather than enduring.

Operatives can relocate farms, replace facilitators, and modify concealment techniques.

For defenders, the central lesson is that employment fraud can establish persistent corporate access.

Hiring verification, device delivery, endpoint telemetry, and identity investigations therefore intersect: a convincing applicant alone does not establish who ultimately controls the employer-issued laptop or where that operator works.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.