FBI and CrowdStrike bust Texas laptop farms aiding North Korean remote-work scheme
Federal authorities partnered with CrowdStrike to dismantle over 40 residential laptop farms across Texas, disrupting an alleged North Korean operation that infiltrated more than 70 U.S. companies using stolen identities.
Federal law enforcement agencies, collaborating with cybersecurity firm CrowdStrike, raided more than 40 residences across Texas to shut down illicit laptop farms used to place North Korean operatives into remote U.S. corporate jobs. The Department of Justice announced two arrests, charges against 14 individuals, and the seizure of at least 187 devices and redirection tools used to disguise connections originating abroad.[1][2][3][4][5][6]
The network relied on U.S.-based facilitators who hosted company-issued laptops inside private homes so foreign operatives could log in via keyboard-video-mouse hardware and remote desktop software. Using fake credentials and stolen identities of real American citizens, the workers bypassed human resources screenings and background checks to infiltrate more than 70 corporate networks, including technology companies, financial institutions, and defense contractors.[1][5]
CrowdStrike identified the group behind the operation as Famous Chollima, a state-sponsored cluster dedicated to deploying fraudulent IT workers to generate revenue for the North Korean regime. Federal prosecutors charged domestic facilitators and overseas managers with wire fraud, money laundering, and identity theft, reporting that workers' salaries—often reaching hundreds of thousands of dollars each—were laundered through cryptocurrency exchanges and shell accounts before reaching state-linked entities.[1][2]
Key facts
- Federal authorities worked with CrowdStrike to dismantle more than 40 residential laptop farms across Texas.
- The Department of Justice announced two arrests and charges against 14 individuals in connection with the crackdown.
- Investigators seized more than 187 devices and redirection tools used to mask connections from overseas.
- North Korean IT workers allegedly infiltrated more than 70 U.S. companies across the tech, financial, and defense sectors.
- CrowdStrike identified the operation as the work of Famous Chollima, a North Korean state-sponsored threat group.
- Domestic hosts kept company laptops in Texas homes while foreign workers controlled them using remote desktop software and KVM hardware.
- Salaries from the fraudulent jobs were laundered through cryptocurrency exchanges and shell companies before reaching North Korean state-linked entities.
Sources · 6 sources
- WE
webulite@webulitePost on X ·
Federal law enforcement agencies, in close collaboration with cybersecurity firm CrowdStrike, executed a major joint operation across Texas to dismantle over forty illicit laptop farms. The coordinated raids targeted a sophisticated network of domestic facilitators enabling North Korean IT workers to secretly secure remote positions at dozens of corporate entities. Authorities seized nearly two hundred laptops and hardware redirection tools used to obscure overseas connections. The operation disrupted a key revenue stream that funneled millions of dollars into sanctioned state programs. The scheme relied on U.S.-based facilitators who hosted company-issued laptops inside residential locations across Texas. Foreign operatives positioned in overseas hubs logged into these devices using keyboard-video-mouse hardware and remote desktop software, making it appear as though the work was being performed within American borders. To pass initial background checks and human resources screenings, the operatives used stolen identities of real citizens, fake credentials, and compromised online profiles. The network targeted tech companies, financial institutions, and defense contractors, allowing foreign actors to gain unauthorized access to internal corporate networks. CrowdStrike identified the specific threat cluster behind the activity as Famous Chollima, a state-sponsored threat group known for deploying fraudulent IT workers to generate hard currency for the regime. In addition to physical seizures, federal prosecutors unsealed indictments charging fourteen individuals, including domestic facilitators and overseas managers, with wire fraud, money laundering, and identity theft. Authorities revealed that the vast majority of salaries earned through these fraudulent remote contracts—often reaching hundreds of thousands of dollars per worker—were laundered through cryptocurrency exchanges and shell company accounts before being transferred to state-linked entities. While the enforcement actions significantly disrupted regional operations, intelligence officials and cybersecurity experts cautioned that the broader threat remains active. State-backed IT worker schemes have adapted rapidly to changing corporate hiring trends, leveraging modern remote-work infrastructure and artificial intelligence tools to scale job applications and evade initial technical checks. Law enforcement agencies continue to urge corporate security teams to implement strict identity verification procedures, track hardware shipping destinations, and monitor for unauthorized remote access tools across enterprise networks.
Open source - CN
CBS News@CBSNewsPost on X ·
Federal authorities seized more than 187 devices from 40 residences in Texas as part of a crackdown on so-called "laptop farms" allegedly used by North Korean operatives to pose as American IT workers and funnel wages to North Korea. FBI Cyber Division Assistant Director Brett Leatherman and CrowdStrike executive Adam Meyers joined CBS News’ Major Garrett to explain how the scheme works.
Open source - SE
SecurityWeek@SecurityWeekPost on X ·
US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms https://t.co/pBa6dh7Ro1
Open source - TH
Tom's Hardware@tomshardwarePost on X ·
FBI shuts down over 40 North Korean laptop farms used by fake remote workers https://t.co/zWSjYNcaAE
Open source - AI
Analytics Insight@analyticsinmePost on X ·
𝗙𝗕𝗜 𝗥𝗮𝗶𝗱𝘀 𝟰𝟬 𝗧𝗲𝘅𝗮𝘀 𝗛𝗼𝗺𝗲𝘀 𝗶𝗻 𝗣𝗿𝗼𝗯𝗲 𝗶𝗻𝘁𝗼 𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮𝗻 𝗜𝗧 𝗪𝗼𝗿𝗸𝗲𝗿 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 North Korean IT workers allegedly infiltrated more than 70 US companies using stolen identities and fraudulent remote jobs. The DOJ has announced two arrests, charges against 14 individuals and the seizure of 187 devices in a major crackdown on suspected foreign revenue-generation networks. #Cybersecurity #NorthKorea #Cybercrime #DataSecurity #USJusticeDepartment #AnalyticsInsightUAE Read More 👇 https://t.co/bOdO0CYqVu
Open source - TE
Techmeme@TechmemePost on X ·
The FBI says it worked with CrowdStrike to dismantle 40+ laptop farms across Texas used to help North Koreans get remote US tech jobs under stolen identities (@dnvolz / New York Times) (Visit Techmeme dot com for the link and full context!)
Open source