FBI Disrupts North Korean IT Worker Scheme, Seizes 187 Laptops in Texas
The U.S. Department of Justice (DOJ) has disrupted a North Korean remote IT worker operation by arresting two suspects, indicting 14 people and seizing approximately 187 laptops used to support the scheme.
The operation was linked to the well-known Chollima threat group, also known as WageMole. The North Korean threat actor is associated with fraudulent IT worker schemes that generate revenue for the North Korean regime.
How North Korea’s remote IT worker scheme operates
Because North Korea is subject to extensive international sanctions, its operatives seek technology-related jobs at companies around the world. They often use stolen, rented or fabricated identities to appear eligible for employment.
In some cases, the workers may attempt to infiltrate an employer’s network to steal sensitive data, introduce malware, or obtain cryptocurrency and other assets.
Intermediaries in the United States host employer-issued laptops at so-called laptop farms. North Korean IT workers then access the devices remotely, creating the appearance that they are working from the United States.
FBI seizes laptops and KVM devices in Texas
As part of an operation in Texas codenamed Lone Star Roundup, the FBI searched 40 homes suspected of operating laptop farms from September 21 to September 25.
Law enforcement seized approximately 187 laptops and KVM input devices. The equipment was used by a prominent Chollima operative who had been tracked by cybersecurity firm CrowdStrike since April 2025.
Methods used to redirect company laptops
According to CrowdStrike researchers, North Korean IT workers used several methods to send company-issued laptops to a laptop farm instead of the address listed on the worker’s identification:
- Filing a fake theft report to trigger a replacement shipment to the laptop farm
- Rotating residential addresses to obscure the devices’ final destination
- Requesting a last-minute relocation to repurpose a device while it was being shipped
- Abusing IT staff roles to secretly redirect shipments
CrowdStrike said that public exposure pressured the operatives to rely more heavily on spoofing device IDs and reusing them across victim organizations.
Although CrowdStrike acknowledged that operations such as Lone Star Roundup are likely to have a limited impact, the company described the action as “the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.”
DOJ indictment details a $3 million operation
The DOJ also released an indictment in Ohio describing a remote IT worker scheme that operated from 2019 through July 2025. The scheme affected 70 companies across the country and generated approximately $3 million for North Korean threat actors.
The employees used stolen or fabricated identities, VPNs and proxy infrastructure to appear as though they were based in the United States. American intermediaries hosted company-issued laptops, installed remote access software and transferred proceeds to accounts controlled by North Korea.
Authorities arrested two Americans, Michael James Bostel and Juan Cecilio Pena Carrillo. They face charges of wire fraud, money laundering and identity theft.
Separately, the Department of Justice announced similar charges against 12 Chinese defendants, bringing the total number of indicted people to 14.
Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, correct and revalidate at machine speed.
Source: www.bleepingcomputer.com