CrowdStrike and the FBI have disrupted a DPRK-nexus operation known as FAMOUS CHOLLIMA, seizing 187 laptops across Texas and arresting two people in Ohio, in a coordinated action that CrowdStrike says disrupted a campaign affecting more than 70 US companies.

Dubbed Operation Lonestar Roundup, the action targeted so-called “laptop farms” that let North Korean IT operatives pose as legitimate remote employees at US companies. The operatives reportedly use AI-generated profiles, doctored images and deepfakes to build fraudulent identities, secure jobs and gain access to corporate systems.

A business and national security threat

CrowdStrike describes the scheme as both a business risk and a US national security threat: salaries paid to the operatives are believed to help fund North Korea’s weapons programmes, while their access to corporate networks creates openings for data theft.

CrowdStrike was the only private-sector company involved in the operation, providing the FBI with telemetry and adversary infrastructure intelligence that law enforcement could not access independently. Real-time information sharing between the two also enabled coordinated action against multiple laptop farms simultaneously.

Public-private collaboration against state-linked threats

The operation underscores the growing role of threat intelligence vendors in supporting law enforcement action against state-linked cyber threats, particularly schemes that exploit remote-hiring practices.

CrowdStrike said it will continue supporting law enforcement partners in identifying and dismantling similar infrastructure as North Korean IT worker schemes keep evolving.