The US Department of Justice, working with the FBI and CrowdStrike's Counter Adversary Operations team, charged 14 individuals and dismantled more than 40 'laptop farms' used by the DPRK-nexus FAMOUS CHOLLIMA programme, in which operatives posing as US-based remote IT contractors infiltrated dozens of companies across aerospace, energy, financial services, healthcare, cybersecurity, defence engineering and government technology to steal data and siphon wages back to the regime. Laptop farms solve the adversary's physical, financial and legal problems: they provide a US address to receive employer hardware, defeat geolocation-based fraud controls and satisfy know-your-client checks. CrowdStrike has observed operatives filing fraudulent police reports to trigger replacement laptop shipments to farm addresses, spoofing device hashes since May 2026, reusing the same disguised device across multiple victim organisations, and hiding remote-access tools such as AnyDesk, OBS Studio and PiKVM. CrowdStrike cautions the disruption only slows the operation in the areas taken down; Australian and NZ enterprises hiring remote IT contractors should revalidate identity-verification processes and screen for reused identity artefacts, mismatched time zones and address discrepancies.

• Source article