DOJ charges 14 over a sprawling North Korean remote work scheme
DOJ charges 14 in North Korea remote work scheme funneling $3M to Pyongyang.
Run DOJ?
Get an email when a reviewed story names DOJ, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The U.S. Department of Justice has charged 14 individuals in a scheme that used stolen identities to facilitate North Korean workers holding remote jobs at over 70 U.S. companies, funneling approximately $3 million to Pyongyang. This operation, dubbed 'Operation Lonestar Roundup,' involved 'laptop farms' in Texas where facilitators maintained employer-issued laptops for overseas North Korean engineers. The funds are believed to support North Korea's weapons programs, circumventing international sanctions.
The lesson from this incident
Full lessonThis case exposes a sophisticated identity fraud scheme where stolen identities enabled North Korean nationals to infiltrate over 70 U.S. companies as remote workers, channeling $3 million to Pyongyang. The root failure lies in weak employee identity verification processes during hiring, combined with poor insider threat awareness among HR and IT teams. Physical 'laptop farms' operated undetected because companies lacked controls to verify the true geographic location of remote workers using their issued equipment. This matters not only because it violates U.S. sanctions law but because these workers likely had privileged access to sensitive company systems and intellectual property.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.