US Dismantles North Korean Laptop Farms Infiltrating Corporate Tech Jobs
Federal authorities bust covert networks placing sanctioned operatives into remote enterprise roles.
1Federal Infiltration Indictment
Federal prosecutors charged 14 individuals in Ohio for facilitating remote tech jobs for North Korean operatives across 70 domestic companies. Ten China-based defendants remain at large alongside two arrested domestic facilitators. The covert operation extracted roughly $3 million in direct payroll funds between 2019 and July 2025.
2Texas Laptop Farms Raided
Investigators searched over 40 residential laptop farms across Texas during Operation Lonestar Roundup, seizing about 187 computers and remote KVM hardware. Domestic facilitators hosted hardware to bypass corporate geolocation defenses. This enabled overseas workers to appear as local employees while funneling salaries to Pyongyang's sanctioned state programs.
3Mechanics of Domestic Proxying
North Korean operatives paid US accomplices to pass video interviews, submit drug screenings, and run remote-access tools on corporate hardware. An uncharged Ohio conspirator routed $320,000 across fraudulent profiles, while a Texas host generated $190,000. Compromised identities belonging to over 25 Americans masked the illicit overseas connections.
4Enterprise Sectors Compromised
The infiltration spanned healthcare, cyber support, retail, manufacturing, and communications across 17 states and Washington, D.C. Operatives used spoofed LinkedIn profiles and stolen identities to secure employment. Beyond wage extraction, the FBI warned that these insider operatives routinely steal proprietary corporate data and extort employer networks.
5Scale of State Revenue
The Treasury Department estimated the broader DPRK remote worker scheme generated over $800 million in fiscal year 2024. Reports indicate operatives remit 85% to 90% of their earnings directly to Pyongyang. This workforce strategy operates alongside state crypto thefts, which netted over $2 billion in 2025.
6Targeting Domestic Enablers
The ongoing crackdowns operate under the federal DPRK RevGen: Domestic Enabler Initiative, pairing counterintelligence units against local hosts. The State Department offers rewards up to $5 million for actionable intelligence. Prosecutors emphasized that running dozens of corporate laptops at home eliminates plausible deniability for participating US citizens.
7Precedent of Heavy Sentences
Recent convictions demonstrate severe judicial penalties for domestic enablers aiding North Korean networks. An Arizona woman received 102 months in prison for managing a $17 million laptop ring affecting 300 firms. Similarly, two New Jersey facilitators received federal prison sentences of 108 and 92 months earlier this year.
8Tactical Resilience and FAMOUS CHOLLIMA
CrowdStrike, which tracks the threat actor as FAMOUS CHOLLIMA, noted North Korea drives roughly half of observed manual cyber intrusions. While laptop seizures disrupt regional infrastructure, analysts caution the enforcement actions provide temporary local setbacks rather than permanently dismantling Pyongyang's sophisticated, highly adaptable global proxy employment architecture.
9Rethinking Remote Hiring Defenses
The FBI warns thousands of state-controlled North Korean IT workers remain active inside Western enterprises. Organizations must urgently re-evaluate distributed onboarding security, hardware verification logistics, and device management protocols. Simple geolocation tracking and remote identity validation no longer protect enterprise environments from sophisticated, state-sponsored domestic proxy networks.
Original article: Gizmodo — US Dismantles North Korean Laptop Farms Infiltrating Corporate Tech Jobs