[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyml4kvffBDChAF-bpLvupsT-6iqDYOKOIaeCr2ibFXE":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f90c35b4-fc01-4bda-82e9-45ef28f255bc","DOJ charges 14 over a sprawling North Korean remote work scheme","doj-charges-14-over-a-sprawling-north-korean-remote-work-scheme-cce47c","Operation Lonestar Roundup uncovered an operation that used stolen identities to secretly funnel $3 million from 70 U.S. employers back to Pyongyang. The post DOJ charges 14 over a sprawling North Korean remote work scheme appeared first on CyberScoop.","The U.S. Department of Justice has charged 14 individuals in a scheme that used stolen identities to facilitate North Korean workers holding remote jobs at over 70 U.S. companies, funneling approximately $3 million to Pyongyang. This operation, dubbed 'Operation Lonestar Roundup,' involved 'laptop farms' in Texas where facilitators maintained employer-issued laptops for overseas North Korean engineers. The funds are believed to support North Korea's weapons programs, circumventing international sanctions.","DOJ charges 14 in North Korea remote work scheme funneling $3M to Pyongyang.","https:\u002F\u002Fcyberscoop.com\u002Fdoj-north-korea-remote-work-laptop-farms\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-2192647275.jpg","2026-10-13T21:43:23+00:00","2026-10-13T22:00:04.20555+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"North Korea","threat_actor",{"name":21,"type":22},"Operation Lonestar Roundup","campaign",{"name":24,"type":25},"CrowdStrike","product",{"name":27,"type":28},"DOJ","vendor",{"name":30,"type":28},"FBI","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[27,30,24],{"controls":57,"vendors":130},[58,87,105],{"slug":59,"name":60,"problem":61,"products":62},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[92,97],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":93,"product_name":94,"url":95,"description":96},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":127,"url":128,"description":129},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"north-korean-remote-work-fraud-identity-theft-funds-weapons-programs","North Korean Remote Work Fraud: Identity Theft Funds Weapons Programs","This case exposes a sophisticated identity fraud scheme where stolen identities enabled North Korean nationals to infiltrate over 70 U.S. companies as remote workers, channeling $3 million to Pyongyang. The root failure lies in weak employee identity verification processes during hiring, combined with poor insider threat awareness among HR and IT teams. Physical 'laptop farms' operated undetected because companies lacked controls to verify the true geographic location of remote workers using their issued equipment. This matters not only because it violates U.S. sanctions law but because these workers likely had privileged access to sensitive company systems and intellectual property.",[136,137,138,139,140,141,142,143,144,145],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-12: Identity Proofing","NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-207: Zero Trust Architecture","NIST CSF ID.AM-6: Cybersecurity roles and responsibilities","ITIL Service Transition: Access Management","Executive Order 13694: Sanctions on Malicious Cyber-Enabled Activities","31 CFR Part 510: North Korea Sanctions Regulations (OFAC)",{}]