FBI raids Texas laptop farms tied to North Korean IT schemes
Operation Lonestar Roundup seized 187 devices, charged 14 people, and affected more than 70 US companies, the FBI says.
Stories per day · 30 days
5 RSS
Relatedfbi2crowdstrike1espionage1famous-chollima1gift-card-fraud1indictment1insider-threat1it-workers1kimsuky1konni1laptop-farm1laptop-farms1north-korea1phishing1ta4061ukraine1wagemole1
30 stories, newest first · one card per story
Stories tagged #dprk
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
FBI raided Texas laptop farms, arrested two Americans, and charged people tied to DPRK IT-worker schemes.
2
North Korea Phishes Ukrainians for War Intel
North Korean hackers are spear-phishing Ukrainian officials and researchers to collect intelligence on the Russia-Ukraine war.
3
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
DPRK-linked hackers added Ethereum HashHiding so malware can recover C2 addresses from ordinary transfers.
2
Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves
Attackers compromised Bitget's backend wallet infrastructure on September 24, stealing $387.5 million; ZachXBT exposed DPRK-linked launderers seeking swap help in public chats.
5
Bitget blames North Korea for $387.5M crypto wallet raid
Bitget says North Korean hackers stole about $387.5 million via its wallet backend.
2
North Korean hackers suspected in $351M crypto theft, the largest so far this year
Suspected North Korean hackers stole about $351 million in crypto from Bitget hot wallets.
2
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
5
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
Contagious Interview: 30,000 devices infected by a fake job interview
North Korea-linked WaterPlum infected over 30,000 devices through fake job interviews, stealing about $10.7 million.
2
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korea's Contagious Interview campaign hit 30,000 devices and stole about $10.71 million in crypto.
3
Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure Across Two Countries
North Korea's Hangro VPN exposed detailed infrastructure across North Korea and Russia via TLS certificates.
3
North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure
New Hangro VPN certificates tie North Korean and Russian Far East servers to a shared management PKI, exposing an internal carrier-grade NAT address.
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
North Korea's fake job interviews infected 30,000 devices
International advisories attribute 30,000 compromised devices, 7,000 crypto wallets, and $10.71 million in thefts to North Korea's WaterPlum fake-recruiter malware campaigns.
1
Nations take action on North Korean IT workers after UN report
Multiple countries took legal action against North Korean IT worker facilitators following a new UN-linked MSMT report on the illicit scheme.
3
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
Researchers discovered WeaselBiscuit, a stripped-down JavaScript stealer delivered via 13 malicious npm packages, harvesting Chrome extension storage with suspected DPRK links.
2
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.
3
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
North Korea-linked IT Workers Are Getting Hired Inside Western Companies
Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.
2
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.
3
North Korean remote workers are broadening their job hunt beyond IT
Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.
1
Red Flags That Expose Fake North Korean IT Workers
Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.