North Korean Hacking Group Exploits Remote-Work Loopholes... CrowdStrike Identifies Signs of Device Identifier Spoofing Using Laptop Farms

The impersonation tactics used by North Korean-linked hacking groups to land jobs in the U.S. have become more sophisticated. In the past, they were known to use laptop farms in the U.S. to conceal their real locations and identities, but more recently, signs of device identifier spoofing have also emerged, making their efforts to evade security detection even more advanced.

Against this backdrop, CrowdStrike said in an announcement on the 19th that it had moved to respond to the North Korea-linked threat group FAMOUS CHOLLIMA in cooperation with the FBI. CrowdStrike said its collaboration with the FBI led to the shutdown of several laptop farms operating across the U.S.

FAMOUS CHOLLIMA is understood to have used laptop farms to secretly place operatives at U.S. companies while hiding their real locations and identities, funneling unlawfully obtained salaries to the North Korean regime. In the process, accomplices in the U.S. reportedly received company-issued laptops on their behalf and established remote access environments, while North Korean personnel posed as legitimate U.S.-based workers to access company systems.

According to CrowdStrike's analysis, North Korean operatives were involved. They used false and stolen identities to get hired, along with deceptive tactics such as fake police reports, last-minute claims of moving, and routing through IT staffing firms. Their goal was to induce employers to ship laptops to laptop farms, and they concealed their use of RMM tools during the activity.

They also spoofed device hashes starting in May 2026 and disguised video capture cards as webcams. A representative tactic was the webcam disguise using video capture cards. In several victim organizations, the same disguised device appeared to have been reused, and in laptop farm networks, multiple fake accounts were also found sharing the same device identifier.

These signs show that the attackers were aware of the indicators defenders use to track them. The number of victim organizations the company identified through its joint operation with the FBI ran into dozens. The affected industries included aerospace, energy, finance, healthcare, and cybersecurity, and the attacks targeted companies with remote-work capabilities across the board.

Adam Meyers, CrowdStrike's head of attack response operations, said laptop farms remove the physical, financial, and legal problems that are hard to solve abroad, making them an essential part of FAMOUS CHOLLIMA's money-making activity. He said this operation is a sign that law enforcement and CrowdStrike are identifying the attackers' infrastructure and actively tracking their movements.

Meyers said that blocking a single laptop farm may have limited impact, but operations like this force attackers to rebuild infrastructure and move their bases, raising the cost of their activity. He also said known personas and indicators can change easily, and recommended that companies perform standard identity checks when vetting candidates, look for repeated information across multiple profiles, and check whether remote-computing applications are being used and whether there are discrepancies between a person's residence and shipping address.

CrowdStrike said it had worked with the FBI to shut down several laptop farms operating across the U.S., but judged that this step alone would not fundamentally stop North Korean hacking activity. Even if some laptop farms are shut down, it said attackers could rebuild infrastructure in other regions and continue their operations by securing new accomplices.

Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=408373

References

• https://www.epnc.co.kr/news/articleView.html?idxno=408373