FBI busts North Korean laptop farms used to infiltrate US workplaces

US authorities have arrested two suspects and seized nearly 190 devices in a crackdown on North Korea's fake remote IT workers. The FBI warns that the scheme is expanding to include identity theft, extortion and even threats of physical violence.

North Korean operatives have been posing as US-based workers to quietly land remote IT jobs at American companies, gaining access to sensitive corporate systems while collecting salaries. Now, a federal crackdown has exposed the scale of the operation and the increasingly aggressive tactics that keep it running.

Key takeaways

• US authorities have disrupted a North Korean remote IT worker scheme affecting more than 70 American companies
• Two suspects were arrested, 14 people were charged and 187 devices were seized
• Fraudulent IT workers used stolen identities and US-based laptop farms to conceal their actual locations
• The scheme generated $3 million, with proceeds believed to have reached North Korean-controlled entities
• The FBI warns that operatives increasingly recruit Americans to help them pass identity checks and secure remote jobs
• Some operatives have resorted to data extortion, death threats and physical intimidation

Nearly 190 devices seized in nationwide investigation

The US Department of Justice announced on Oct. 13 a series of coordinated actions targeting North Korea's state-backed remote IT worker operations.

The investigation resulted in charges against 14 individuals, including two Americans who were arrested in connection with an alleged multimillion-dollar employment fraud scheme.

According to the Justice Department announcement, the operation affected more than 70 companies in the healthcare, communications, cybersecurity support, retail and manufacturing sectors.

The alleged scheme ran from 2019 until July 2025, generating more than $3 million in revenue believed to have been funneled to sanctioned entities controlled by North Korea.

Separately, FBI agents conducted searches and other actions at more than 40 Texas residences suspected of hosting equipment for North Korean IT workers.

The effort, dubbed Operation Lonestar Roundup, resulted in the seizure of 187 laptops and keyboard-video-mouse (KVM) devices used to remotely access employer-issued computers.

The operation targeted infrastructure associated with a North Korean threat group tracked by cybersecurity firm CrowdStrike as Famous Chollima.

How North Korean operatives trick companies into hiring them

The scheme exploits a defining feature of modern employment: remote work.

North Korean operatives apply for legitimate IT jobs using stolen identities, fabricated documents, fake professional profiles and technical measures designed to make them appear to be working from the United States.

Once hired, they receive access to company systems, development environments and potentially sensitive business information.

But the laptops provided by their employers aren't necessarily shipped to the people actually doing the work.

Instead, the devices are sent to US-based accomplices who operate so-called laptop farms — collections of computers that remain physically connected to the internet inside American homes.

The North Korean workers then access those machines remotely, making it look like their activity comes from within the United States.

The arrangement lets them collect salaries while hiding their identities and locations.

According to the FBI, the threat extends well beyond fraudulent employment. Operatives have also stolen sensitive corporate information and used it to extort former employers.

FBI warns Americans are being recruited to help the scheme

In a public service announcement, the FBI warns that North Korean operatives are increasingly recruiting ordinary Americans to bypass improved corporate security checks.

Some of the recruitment efforts specifically target people experiencing financial hardship.

The requests can appear deceptively simple: receive a laptop, keep it connected to the internet, participate in a video interview or allow someone else to use a professional networking account.

In other cases, recruits are asked to complete identity verification procedures, submit fingerprints or even take drug tests on someone else's behalf.

The FBI says operatives sometimes invent elaborate personal stories or create fake companies to make their requests look legitimate.

North Korean workers have also begun subcontracting entire jobs to freelancers in countries such as India, Pakistan and Nigeria, allowing them to collect salaries while paying someone else a fraction of the money to complete the actual assignments.

The FBI estimates that 85% to 90% of the revenue generated by these operations goes to the North Korean government, including programs associated with nuclear weapons and other military development.

From employment fraud to death threats

Perhaps the most disturbing aspect is the growing use of intimidation.

The FBI says some North Korean IT workers have threatened former managers and their families with physical violence after being dismissed.

Others have threatened to publish sensitive corporate information unless employers agreed to additional payments.

In certain cases, operatives allegedly recruited people inside the United States to physically intimidate victims, including by appearing at company premises or the homes of individuals operating laptop farms.

These tactics turn what initially seems like an employment fraud operation into a much broader cybersecurity and personal safety threat.

The FBI also warns that operatives are targeting jobs involving government contractors, defense-related organizations and positions requiring security clearances.

How organizations can thwart fake remote workers

The FBI recommends what it calls an "identity in depth" approach: using multiple verification methods and security controls throughout the employment relationship rather than relying on a single background check.

Companies employing remote developers and IT contractors should consider the following measures:

• Verify identities throughout employment. Use multiple appropriate checks during recruitment and onboarding, and investigate any inconsistencies
• Monitor remote-access activity. Investigate unauthorized remote desktop software, unusual KVM devices and suspicious access patterns
• Limit access to sensitive information. Apply least-privilege principles so employees and contractors can access only the systems necessary for their work
• Watch for unusual account changes. Repeated changes to bank accounts, addresses or professional identities may warrant additional verification
• Coordinate HR and cybersecurity teams. Hiring irregularities and suspicious technical activity may be easier to identify when different departments share relevant findings
• Investigate before taking action. No single technical indicator or applicant characteristic proves malicious activity, and poorly designed checks can unfairly affect legitimate workers

The FBI specifically cautions against relying on simplistic indicators, such as names or national origin, to identify potential operatives.

What remote workers and job seekers should know

Ordinary people can become involved in these schemes through seemingly harmless freelance opportunities, especially those promising easy money for minimal effort.

Be particularly suspicious of offers asking you to receive company laptops on behalf of strangers, participate in job interviews using someone else's identity, or lend out your LinkedIn or other professional accounts.

Never share identity documents, financial information or account credentials with someone offering payment in exchange for helping them obtain employment.

If you've already participated in such an arrangement and discover suspicious activity, preserve relevant messages and documentation and report the incident to the appropriate authorities.

US residents can file complaints through the FBI's Internet Crime Complaint Center (IC3).

On topic:

Police dismantle ransomware gang allegedly run by a 16-year-old

IT engineer gets 32 months in prison after sabotaging employer and demanding $750,000

15,000 Americans caught up in massive cybercrime money laundering scheme