The FBI and CrowdStrike disrupted several U.S. laptop farms used by DPRK-nexus adversary FAMOUS CHOLLIMA to place operatives in remote jobs at American companies. Facilitators received employer-issued devices and configured them for remote access, enabling operatives abroad to conceal their locations, collect wages for the North Korean regime, and retain access to victim organizations. CrowdStrike identified supporting personas, technical indicators, facilitator networks, and U.S.-based computers between April 2025 and June 2026. The affected clusters reached dozens of organizations across technology, defense, aerospace, energy, finance, healthcare, and government-related sectors, but CrowdStrike expects the broader operation to continue adapting.