US raids laptop farms used to funnel $3 million to North Korea in fake candidate scam

Get the ITPro daily newsletter Sign up today and you will receive a free copy of our Future Focus 2026 report – the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.

As part of Operation Lonestar Roundup, 187 computer devices being used by North Korean IT workers were seized, and two people were arrested.

In a scheme labelled Famous Chollima, the fake workers were applying for – and often getting – remote positions by using stolen or fabricated identity documents, VPNs and proxy infrastructure to make it look as though they were working from within the US.

They used US-based co-conspirators to receive laptops from victim companies. These individuals then housed and configured those devices, installed remote-access software and transferred earnings to Korean government‑controlled accounts.

“Operation Lonestar Roundup was aimed at disrupting malicious cyber activity perpetrated by the North Korean government with the purpose of supporting its WMD and ballistic missile programs, intelligence program, and nuclear program,” said FBI Dallas special agent in charge R Joseph Rothrock.

“Each laptop seized potentially represents one company that has hired a DPRK (Democratic People’s Republic of Korea) IT worker.”

US nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas have been arrested for the scheme, which is believed to have generated more than $3 million in revenue. Another dozen people based in China have been charged.

Sign up today and you will receive a free copy of our Future Focus 2026 report – the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.

The companies falling victim included organizations in the health care, communications, cyber support, retail, and manufacturing sectors, with the revenue generated being sent to sanctioned entities controlled by the North Korean government.

The operatives appear to have used a network of fraudulent Google accounts to facilitate their criminal activity.

Employers are being encouraged to add accounts listed by the Justice Department to the list of indicators they use to identify and disrupt North Korean IT worker employment.

CrowdStrike, which worked with the FBI to bring the operation down Famous Chollima operatives have been using a range of deception techniques during onboarding. They’ve filed fraudulent police reports claiming a laptop was stolen to trigger replacement shipments to farm addresses, and rotated through residential addresses to obscure the final destination.

Others have claimed they’ve been forced to relocate at the last minute to divert devices mid-shipment. In some cases, operatives secured roles through IT staffing firms, which allowed end-client devices to be quietly redirected to farm infrastructure without the staffing firm’s knowledge.

This summer, Huntress uncovered at least five North Korean operatives that were part of the Famous Chollima operation and who, between them, were applying for as many as 60 jobs per day.

“This investigation is about far more than fraud,” said US attorney Ryan Raybould for the Northern District of Texas.

“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”

Emma Woollacott Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.

AI agents have a mind of their own – and that’s a problem for businesses New research shows that half of organizations are having to deal with agent behaviour that hasn’t been authorized or approved.

Special agents: the changing face of AI in business and how it’s driving ROI Scaling AI beyond initial experimentation and delivering measurable returns means establishing strong foundations from the outset

US seizes vulnerability scanning and spear phishing tools used by China-sponsored hackers News Integrity Technology Group enabled vulnerability scanning and intrusions targeting US and foreign critical infrastructure

Accenture contractor removed over blunder in lead up to FBI breach News The contractor is believed to have failed to apply a security patch that would have secured Oracle PeopleSoft

Nearly half of CISOs have been hit by AI deepfake voice calls – here’s how to spot the tell-tale signs you’re being scammed News Gartner has urged CISOs to remain vigilant for voice and video social engineering attacks

UK workers are shockingly relaxed about selling access to company systems News Research from UK fraud prevention service Cifas shows that insider fraud is rife

Rethinking fraud prevention: From identity checks to identity signal integrity Sponsored With new techniques being used by criminals, fraud detection has to move with the times to ensure security

Stryker hackers struck by FBI in domain seizure campaign News The domain seizures come hot on the heels of Handala’s devastating attack on the medical tech firm

FBI warns scammers are using cryptocurrency ATMs to siphon cash News Criminals will stay on phone with victims as they make payments, says advisory

Hackers fake DocuSign and offer fraudulent signing methods News Criminals impersonate the e-signing company to steal credentials