[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLY-A_MnkoQ3A0bGO9dHSVWIlGb9eFkcLzkDfr8t7DI0":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0c9c92f3-c609-46ff-85e4-104cc7e99c04","FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested","fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested-f52984","The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]","The FBI has disrupted North Korea's Famous Chollima (WageMole) threat group by raiding \"laptop farms\" in Texas, arresting two US nationals, and charging 14 individuals. These operations were used by North Korean IT workers to remotely access employer-issued laptops, circumventing sanctions and generating revenue for the DPRK regime. The scheme involved redirecting company laptops and using stolen identities, with a separate Ohio indictment detailing a similar operation that impacted 70 companies and generated $3 million.","FBI raids DPRK IT worker laptop farms in Texas, arrests US nationals.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F14\u002Fdoj.jpg","2026-10-14T19:41:43+00:00","2026-10-14T20:00:07.05659+00:00",8,[17,20,22,25],{"name":18,"type":19},"Famous Chollima","threat_actor",{"name":21,"type":19},"WageMole",{"name":23,"type":24},"CrowdStrike","vendor",{"name":26,"type":27},"KVM input devices","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,26],{"controls":54,"vendors":132},[55,83,111],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":77,"vendor_name":23,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":84,"name":85,"problem":86,"products":87},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[88,96,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":98,"url":101,"description":102},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[116,124],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[133],{"slug":77,"name":23,"logo_path":78,"roles":134},[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":152},"north-korean-it-workers-infiltrate-us-companies-via-laptop-farms-and-stolen-identities","North Korean IT Workers Infiltrate US Companies via Laptop Farms and Stolen Identities","North Korean operatives exploited weak identity verification processes during remote hiring to place fraudulent workers inside US companies, gaining direct access to corporate systems and sensitive data. By routing employer-issued laptops through US-based 'laptop farms,' they bypassed geographic sanctions controls and obscured their true locations. This scheme demonstrates that insider threats can be deliberately engineered through the hiring supply chain, not just arise organically. The operation impacted at least 70 companies and generated millions in revenue for a sanctioned nation-state, making it both a cybersecurity and national security failure. Organizations that rely solely on self-reported identity information during remote onboarding are especially vulnerable to this class of attack.",[141,142,143,144,145,146,147,148,149,150,151],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-3 (Device Identification and Authentication)","NIST SP 800-53 PS-3 (Personnel Screening)","NIST SP 800-161 – Cybersecurity Supply Chain Risk Management","NIST CSF ID.SC-2 (Supplier Risk Assessment)","OFAC Sanctions Compliance – 31 CFR Part 510 (North Korea Sanctions)","ITIL – Service Transition \u002F Supplier Management","Executive Order 13694 \u002F 13722 – Sanctions on DPRK Cyber Activities",{}]