The Justice Department charged 14 people, arrested two U.S. nationals and seized nearly 190 devices in a new crackdown on North Korean remote IT worker schemes, an operation authorities say reached more than 70 American companies.
The actions announced on October 13 included searches at more than 40 known or suspected “laptop farms” in Texas and an indictment describing a separate, multiyear employment-fraud operation. Prosecutors allege that workers linked to North Korea used stolen or fabricated identities to secure remote jobs, then relied on U.S.-based facilitators, proxy infrastructure and remotely controlled company laptops to conceal where the work was actually being done.
The cases provide a fresh warning for employers because the underlying threat has moved beyond a fraudulent resume or a suspicious video interview. The FBI’s updated public advisory describes a distributed operation involving American facilitators, foreign subcontractors, hardware remote-control devices and persistent data collection. Its main recommendation is an “identity in depth” program that keeps verifying a worker after hiring instead of treating a background check as the final gate.
What the new operation uncovered
The Justice Department’s announcement combines two related actions. In Ohio, prosecutors accused two U.S. nationals and a group of China-based defendants of participating in a scheme that generated more than $3 million from remote work between 2019 and July 2025. The alleged victims included companies in health care, communications, cybersecurity support, retail and manufacturing across 17 states and Washington, D.C.
In Texas, the FBI searched more than 40 residences during Operation Lonestar Roundup and seized roughly 187 laptops and keyboard-video-mouse devices. CrowdStrike identifies the North Korea-linked operation as Famous Chollima. The cybersecurity company said the disrupted infrastructure served organizations in aerospace, energy, financial services, health care, cybersecurity, defense engineering, government technology and consumer technology.
Authorities say laptop farms give an overseas worker a rented U.S. footprint. An employer sends a computer to a domestic address, where a facilitator keeps it powered and connects remote-access hardware or software. The worker then operates the company device from abroad while its network traffic appears to originate in the United States.
That access can outlast the employment fraud itself. The FBI warns that the workers may record screens, take sensitive corporate data and use stolen information in later identity schemes. The bureau has also observed data-extortion demands and threats of physical violence after employers terminated suspected workers.
The defendants are presumed innocent unless proven guilty. The operational details, however, come from both the new court action and a broader FBI advisory based on investigations extending beyond the charged conduct.
The hiring fraud now has more layers
North Korean operators are increasingly hiring other people to perform individual steps that once exposed the same actor throughout the process. Americans may be paid to appear on camera, sit through an interview, lend a long-established professional profile, verify an identity, receive a laptop, submit fingerprints or complete a drug test. Some are recruited through fake freelance jobs and may not initially understand the operation they are supporting.
The FBI also reports that North Korean workers are subcontracting entire jobs to freelancers, often in South Asia or West Africa, for a fraction of the salary. A legitimate-looking applicant, the person who appears in an interview, the individual completing the work and the operator accessing the corporate laptop may therefore all be different people.
This division of labor weakens simple checks. A U.S. shipping address does not prove the worker is there. A polished interview does not prove the same person will perform the job. A valid identity may belong to a victim, and a professional account with years of activity may have been rented or compromised.
Technical signals security teams can check
The new guidance names both software and hardware that defenders may encounter. Remote-access applications include AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop Streamer, along with remote monitoring and management tools. The presence of one product is not proof of fraud, especially in an IT role, but an installation that does not match the worker’s duties deserves review.
Hardware deserves equal attention. The FBI lists TinyPilot, PiKVM and GL.iNet equipment among devices used to operate employer laptops remotely. CrowdStrike says it has also seen video-capture hardware made to appear as a webcam, with the same disguised device identifier reused at multiple victim organizations.
Other useful signals include:
- an address change after hiring but before equipment ships;
- a residential address that does not match the requested delivery address;
- logins from multiple locations or at hours inconsistent with the worker’s claimed time zone;
- reused phone numbers, bank accounts, email addresses, resume language or website copy across several identities;
- new or thin profiles on LinkedIn, GitHub and freelance platforms;
- remote-control software, OBS Studio with VDO.Ninja, Homebrew or unrelated applications appearing on a managed device;
- unexplained screen recording or recurring outbound data transfers; and
- references, followers or professional connections that link back to other suspected personas.
None of those indicators should be used as a stand-alone rejection rule. The FBI explicitly cautions that aggressive filters can create false positives, harm legitimate workers and block qualified applicants. Nationality, accent and broad name lists are particularly poor substitutes for evidence.
How to build identity checks through employment
An effective response joins HR, IT, security and management data instead of asking one team to spot every inconsistency. Employers can start with five controls:
- Bind the interview to onboarding. Compare live video, approved identity documents and later interactions, using a documented escalation process for discrepancies rather than an automated rejection.
- Control equipment delivery. Require review of late address changes, record who accepted a device and investigate repeated shipping destinations across unrelated workers.
- Restrict remote administration. Allow only approved support tools, alert on new remote desktop services and inventory KVM-over-IP or video-capture hardware connected to corporate laptops.
- Reverify identity at sensitive events. Repeat checks before granting production access, changing payroll details, shipping replacement hardware or approving a major privilege increase.
- Correlate weak signals. A time-zone mismatch, new payment account or unusual application may be harmless alone. Several together should trigger a human review that can distinguish fraud from ordinary remote-work changes.
Third-party staffing does not remove the risk. Companies should require staffing firms to document their verification practices, audit address and payment changes, and preserve enough onboarding evidence to investigate an incident. A contractor with privileged access can create the same exposure as a direct employee.
What to do when a worker is suspected
The FBI recommends preserving network activity from the employee’s account and assigned device, collecting relevant messages and identity records, and filing a report with the Internet Crime Complaint Center. Organizations should involve legal counsel and their incident-response team before confronting the worker or wiping equipment, particularly where data theft or extortion may be involved.
Access removal should cover more than a laptop login. Review source-code repositories, cloud credentials, API tokens, password-manager access, remote support tools, email forwarding rules and any secrets available to the account. Investigators should also check whether the device was replaced, redirected or connected through an unexpected KVM or capture device.
The latest seizures will interrupt some infrastructure, but they are unlikely to end the model. CrowdStrike says the group has already spread laptop farms across more locations with fewer machines at each site, reducing the effect of any single raid. For employers, the durable defense is not a static list of names or email addresses. It is a system that keeps matching the person, device, location and access pattern throughout the working relationship.
.jpg){kind=link}