North Korean IT Workers Used Stolen US Identities to Earn $3 Million
FBI raided Texas laptop farms as DOJ charged US facilitators of North Korean IT workers who earned $3 million from over 70 companies.
The US Justice Department announced coordinated actions against North Korea’s remote IT worker scheme, including two arrests, 14 people charged across two indictments, and FBI searches of more than 40 Texas homes under Operation Lonestar Roundup. Agents seized about 187 employer-issued laptops and KVM devices. An Ohio indictment says the operation ran from 2019 to mid-2025, affected more than 70 companies in 17 states, and generated about $3 million believed sent to sanctioned DPRK entities. CrowdStrike attributes the activity to Famous Chollima and says laptop farms preserved persistent access while wages flowed to the regime.
- FBI searched 40-plus Texas homes and seized about 187 laptops and KVM switches.
- Scheme hit more than 70 US employers in healthcare, communications, cyber support, retail, and manufacturing.
- Workers used stolen identities, VPNs, and US facilitators who ran laptop farms.
- CrowdStrike tracks the operators as Famous Chollima; FBI says thousands remain embedded.
- Fifth DOJ DPRK RevGen enforcement round since June 2025.
- ATT&CK
- T1078 Valid AccountsT1656 ImpersonationT1219 Remote Access SoftwareT1090 ProxyT1036 Masquerading
- Vendors
- CrowdStrike
- Threat actors
- Famous Chollima
- Countries
- North KoreaUnited States
From the original article
4 min read at securityaffairs.com
The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme to place fake IT workers inside American companies. Two US nationals were arrested, 14 people […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.