Threat Intel
CrowdStrike and FBI Disrupt DPRK‑Nexus FAMOUS CHOLLIMA Laptop Farms Targeting U.S. Companies
U.S. authorities, with CrowdStrike support, dismantled laptop farms run by the DPRK‑linked threat actor FAMOUS CHOLLIMA that were used to deploy malicious operatives into American firms. The operation exposed compromised endpoints and highlighted the need for rigorous endpoint monitoring. Defenders should audit laptop usage, enforce strict device authentication, and leverage CrowdStrike Falcon for detection.
What Happened
On 13 October 2026, the FBI, assisted by CrowdStrike, seized several laptop farms operated by the DPRK‑linked threat actor FAMOUS CHOLLIMA. The farms were used to fraudulently deploy compromised laptops into American companies, enabling covert operations.
Who Is Affected
All U.S. organizations that had laptops from the compromised farms, especially those in finance, defense, and critical infrastructure sectors, are at risk of having their systems infiltrated.
Impact
The disruption exposed a network of compromised endpoints that could have provided attackers with persistence, lateral movement, and data exfiltration capabilities. The incident underscores the threat of supply‑chain attacks via stolen or pre‑compromised hardware.
What to Do
- Audit all laptops for signs of compromise: unusual processes, unknown remote‑access tools, or unauthorized firmware.
- Enforce device‑level authentication and zero‑trust policies; restrict use of external devices.
- Deploy CrowdStrike Falcon XDR to detect anomalous lateral movement and command‑and‑control traffic.
- Coordinate with the FBI’s Cyber Crime Unit for threat intel updates and incident response guidance.
Related articles
U.S. Government Disrupts DPRK‑Linked FAMOUS CHOLLIMA Laptop Farms with CrowdStrike Support
The FBI and CrowdStrike dismantled several laptop farms operated by the DPRK‑affiliated threat group FAMOUS CHOLLIMA, exposing fraudulent use of compromised laptops within U.S. companies. Defenders should audit remote‑access logs, isolate affected devices, and strengthen endpoint detection and response controls.
Read briefing
U.S. Government Disrupts DPRK‑Linked FAMOUS CHOLLIMA Laptop Farms
The FBI and CrowdStrike dismantled a network of laptop farms run by the DPRK‑affiliated threat actor FAMOUS CHOLLIMA, which was deploying stolen credentials to infiltrate U.S. companies. The operation exposed compromised laptops and credential reuse across multiple organizations. Defenders should audit device inventories, enforce least‑privilege access, and monitor for anomalous credential use.
Read briefing
China AI Firms Launch Industrial-Scale Knowledge Distillation Attacks on U.S. Models
CISA, NSA, and FBI have issued a joint warning that Chinese AI companies are deploying large‑scale knowledge distillation campaigns to siphon data from U.S. AI models. By extracting distilled knowledge, attackers can accelerate their own development while bypassing costly training. The threat poses risks to commercial, governmental, and national‑security AI systems, prompting urgent calls for tighter model protection and monitoring.
Read briefing
China AI Firms Deploy Industrial‑Scale Distillation to Steal U.S. Model Secrets
The NSA, CISA and FBI have issued a joint advisory warning that Chinese AI companies are conducting large‑scale knowledge‑distillation operations against U.S. frontier models such as Claude, GPT, Gemini and Grok. By routing requests through APIs, cloud services, third‑party aggregators and proxy “transfer stations,” firms like DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI harvest billions of tokens to train their own models, violating terms of use and threatening intellectual‑property security. The advisory details the tactics and recommends mitigation steps for U.S. organizations.
Read briefing