Key points
- The Department of Justice indicted 14 people for wire fraud and identity theft in a scheme affecting over 70 US companies.
- North Korean workers used stolen documents and VPNs to pose as US-based remote IT staff from 2019 through July 2025.
- Authorities seized 187 devices from suspected laptop farms in Texas during Operation Lonestar Roundup.
The Department of Justice announced coordinated actions against a North Korean government scheme that infiltrated more than 70 US companies through remote IT workers. These workers used stolen or fabricated identities to secure employment, generating over $3 million in revenue for sanctioned entities. The operation targeted firms in health, telecom, and manufacturing sectors across 17 states and Washington, DC, according to the indictment.
Federal prosecutors charged 14 individuals, including two arrested US nationals and ten Chinese nationals, with wire fraud, money laundering, and identity theft. The remaining defendants' identities are under seal. The scheme relied on helpers in the US who operated "laptop farms," keeping work devices at home to mask the workers' true location abroad. The FBI seized approximately 187 computer devices during searches of more than 40 suspected farms in Texas.
What we know
From 2019 to around July 2025, the indicted workers applied for remote positions using virtual private networks and proxy infrastructure to appear as US persons. They paid US-based helpers to maintain work laptops, allowing remote access from outside the country. The FBI and DOJ executed Operation Lonestar Roundup to dismantle these networks. Assistant Attorney General John Eisenberg stated the regime uses these schemes to fund weapons development. The FBI issued a public service announcement with mitigation guidance for companies facing similar threats.
Defender's checklist
- Review remote employee onboarding procedures for identity verification gaps.
- Audit VPN logs for connections originating from unexpected geographic locations.
- Monitor for unusual access patterns that may indicate shared credentials.
- Verify that physical hardware remains within authorized corporate networks.
What analysts watch for
Teams usually examine network logs for connections that originate from regions inconsistent with employee profiles. Analysts check whether multiple sessions share the same IP address or device fingerprint, which can indicate shared hardware. They look for anomalies in login times that suggest shift-based access from different time zones. Investigators also review identity documents for signs of tampering or forgery during background checks.
What to do and how to stay safe: North Korea
- Implement multi-factor authentication for all remote access to reduce the risk of credential theft.
- Verify employee identities through government-issued documents and biometric checks during onboarding.
- Monitor network traffic for connections from countries where no employees are based.
- Ensure physical hardware is tracked and inventoried to prevent unauthorized remote access.
Step-by-step guide: Threat Hunting Explained: Proactive Security Beyond Alerts
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many US companies were affected by this scheme?
More than 70 US companies were affected by the North Korean remote IT worker scheme.
What charges were filed against the 14 individuals?
The 14 individuals were charged with wire fraud, money laundering, and identity theft.
Did the FBI seize any devices?
Yes, the FBI seized approximately 187 computer devices from suspected laptop farms in Texas.
