US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from inside the US, generating more than $3 million in fraudulent revenue.
Two US nationals were arrested for allegedly supporting a North Korean IT worker fraud operation by housing and configuring company-issued laptops so overseas workers appeared to be working from inside the United States. The indictment alleges the scheme ran from 2019 to July 2025 and generated over $3 million in fraudulent revenue, allegedly impacting more than 70 US companies across sectors including communications, healthcare, manufacturing, and financial services.
The operation relied on fake or stolen identities combined with VPN and proxy infrastructure to mask the workers' true locations. The FBI's Operation Lonestar Roundup searched 40 Texas locations and seized 187 laptops and KVM devices suspected of supporting these laptop farms.
The scheme exploited routine HR and IT asset processes that are not typically treated as security controls. Shipping address changes for new hires, and replacement requests for lost or stolen devices, were used as cover to redirect company hardware to farm locations. CrowdStrike reports the group, tracked as Famous Chollima, used shipment diversion tactics such as relocation claims, rotating addresses, and staffing firm cover, along with replacement scams involving fake stolen-laptop police reports.
Facilitators were also reportedly paid to appear on camera during interviews or meetings, verify identities, share social accounts, ship packages, or keep devices connected to the internet from US residences, making it harder for a single verification step to catch the deception.
Organizations are encouraged to treat device shipping and address changes as a security control rather than an HR convenience, verifying changes out-of-band and documenting approvals. Replacement requests for lost or stolen hardware should require stronger verification before new devices are issued.
Because no single check reliably identifies these schemes, the recommended approach is "identity in depth," layering access controls and detection across the entire employment lifecycle, from application through interview, onboarding, and ongoing access. Training HR, recruiting, IT support, and asset management teams to recognize and escalate facilitator-style behavior, such as stand-ins for interviews or unusual shipping requests, helps close the gaps these schemes depend on.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A laptop farm is a US location where facilitators house and configure company-issued laptops so overseas North Korean IT workers can remotely access them and appear to be working from inside the US.
Operatives used deception tactics such as claiming sudden relocation or filing fraudulent police reports about stolen laptops to get devices shipped or replaced at farm-controlled addresses.
According to the indictment, the scheme ran from 2019 to July 2025 and generated over $3 million in fraudulent revenue, allegedly affecting more than 70 US companies.
Security teams are advised to adopt an identity in depth approach with layered verification throughout the employment lifecycle, since no single check reliably catches these schemes.
North Korean fake IT workers have already used US “laptop farms” to hit over 70 companies and pull in more than three million dollars. Here’s the trick: an email from a “new remote hire” says, “Hi team, I’ve had a sudden relocation. Can you update my shipping address for the company laptop?” That laptop gets sent to a US house, plugged into a laptop farm, and remotely driven from overseas to look like a normal US worker. They’ll also say, “My company laptop was stolen. I filed a police report, please send a replacement as soon as possible.” The catch: the report is fake, and the replacement ships to another farm address. Red flags are last‑minute address changes, repeat “lost or stolen” claims, and replacement laptops going to a different address than HR has on file. If anyone asks to reroute or replace a laptop, treat it like a security event: pause the request, and out‑of‑band verify the person and the address with HR or IT before anything ships.
Researchers created a fake crypto startup and successfully hired three suspected North Korean IT workers by letting them pass normal remote hiring and onboarding checks. The suspected operatives used inconsistent identity documents and remote-access tooling to obtain legitimate employee accounts…
Researchers spotted a Telegram job ad recruiting callers to impersonate the “Google Account Security Team” and run voice-phishing calls. The ad absurdly claimed “NO SCRIPT READING” while also publishing the exact phone script to use, showing a repeatable, real-world vishing workflow.
An alleged North Korean operation called “WaterPlum” targeted job seekers by posing as AI and blockchain companies and using the interview process to trick applicants into downloading malicious files. Authorities say the campaign infected tens of thousands of devices worldwide and led to theft from…
US authorities say North Korean operatives used stolen and fake identities to get hired into remote roles at more than 70 US companies, then operated company laptops from inside the US using “laptop farms.” Americans allegedly helped by receiving employer-issued laptops, keeping them online, and…
The article describes a common fraud pattern where scammers impersonate police, government officials, or other trusted authorities over the phone to pressure victims into paying via a Bitcoin/crypto ATM. The victim is told their money is at risk, instructed to withdraw cash, and then directed to…
The FBI warns about phone scams where callers impersonate police or federal agents and threaten arrest unless the victim pays immediately. The scams use pressure tactics (keeping victims on the phone, urging secrecy) and push hard-to-trace payments like prepaid cards, crypto, wire transfers, or…
