Prosecutors describe a US laptop-farm network that placed overseas workers at more than 100 companies and allege that one worker downloaded controlled technical data from a California defense contractor.
Suspected North Korean remote IT workers have handed corporate access to malware teams when an employer appeared to hold valuable intelligence, CrowdStrike executive Adam Meyers told Fox News. Meyers did not say whether the teams subsequently collected sensitive information.
CrowdStrike began tracking the campaign it calls Famous Chollima in March 2024, after investigating an apparent malicious insider. Investigators soon identified dozens of other victims among its customers. The company links it to North Korea’s Munitions Industry Department and says its primary goal is to generate revenue; Meyers said a valuable employer can also offer an opportunity to collect intelligence.
In a separate federal case, prosecutors described a US-based network of “laptop farms” that helped overseas workers obtain remote jobs at more than 100 American companies. An indictment alleges that a California defense contractor developing equipment using superintelligence (SI) hired an overseas worker using a stolen American identity in January 2024.
Prosecutors said the worker accessed the contractor’s systems for more than two months and downloaded technical data, including material controlled under the International Traffic in Arms Regulations. The indictment said documents obtained from victim companies included information related to sensitive US military technology.
In this scheme, a facilitator in the US receives a company laptop and sets it up for remote operation. An overseas worker using a stolen identity can then operate the laptop while appearing to company systems to be working in the US. In the California case, the first worker’s laptop went to a person in New Jersey and then to a laptop farm, the indictment says.
In another case, two impostors used the identity of a Virginia defense-contractor employee who held an active Top Secret clearance. One received a $130,000 software engineering offer for a military generative SI project, but the employer discovered during a video call that the purported employee did not match the identity he was using. Before that discovery, the employer shipped a laptop to the Virginia man’s home.
The other received a $170,000 offer for a senior engineering job requiring Top Secret/Sensitive Compartmented Information clearance. A background investigation found discrepancies, and a video call showed someone who appeared roughly 30 years younger than the identity holder. Neither impostor performed the sensitive work.
In October 2026, the FBI searched more than 40 suspected laptop farms in Texas and seized 187 laptops and other devices. The US Department of Justice said coordinated actions announced that day affected more than 70 US companies.
Meyers said a hired impostor can receive the access available to an ordinary employee, potentially including valuable company information. He urged employers to treat identity verification as a security issue and train recruiters and security teams to recognize the tactics.
The Federal Aviation Administration plans to replace the aging information systems by the end of 2028. Separately, the first US digital air traffic control towers are operational at airports in Florida and Alaska.
3 min
OpenAI is releasing the cybersecurity model to selected organizations doing authorized defensive work and plans to expand access to all Daybreak Red customers in the coming weeks.
3 min
Google says its video model is available for production through the Gemini API and Google Cloud. It says 720p video costs $0.07 per second, 30% less than Omni 1.1, with clips up to 15 seconds and conversational editing.
2 min
