FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
FBI raids DPRK IT worker laptop farms in Texas, arrests US nationals.
Run CrowdStrike?
Get an email when a reviewed story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The FBI has disrupted North Korea's Famous Chollima (WageMole) threat group by raiding "laptop farms" in Texas, arresting two US nationals, and charging 14 individuals. These operations were used by North Korean IT workers to remotely access employer-issued laptops, circumventing sanctions and generating revenue for the DPRK regime. The scheme involved redirecting company laptops and using stolen identities, with a separate Ohio indictment detailing a similar operation that impacted 70 companies and generated $3 million.
The lesson from this incident
Full lessonNorth Korean operatives exploited weak identity verification processes during remote hiring to place fraudulent workers inside US companies, gaining direct access to corporate systems and sensitive data. By routing employer-issued laptops through US-based 'laptop farms,' they bypassed geographic sanctions controls and obscured their true locations. This scheme demonstrates that insider threats can be deliberately engineered through the hiring supply chain, not just arise organically. The operation impacted at least 70 companies and generated millions in revenue for a sanctioned nation-state, making it both a cybersecurity and national security failure. Organizations that rely solely on self-reported identity information during remote onboarding are especially vulnerable to this class of attack.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.