FBI disrupts North Korean 'laptop farms' used to fund weapons programs

mirsad sarajlic/Getty Images

Agents seized nearly 190 laptops across Texas in a crackdown on fraudulent remote workers.

The FBI searched more than 40 Texas residences and seized 187 laptops and other devices used to help North Korean operatives obtain remote jobs at U.S. companies under false identities, federal prosecutors announced Tuesday.

The effort, dubbed Operation Lonestar Roundup, targeted “laptop farms” that housed employer-issued computers and allowed workers overseas to access them remotely. U.S.-based facilitators configured the devices and transferred earnings to North Korean-controlled accounts, according to the Justice Department .

CrowdStrike, which provided intelligence and technical analysis to support the FBI’s work, said the broader operation affected a campaign targeting more than 70 U.S. companies and included two arrests in Ohio. The company did not identify those arrested or describe the charges in its announcement to reporters. The Justice Department’s Texas release did not address the Ohio arrests.

The scheme gave North Korean workers access to corporate systems while generating revenue for the regime’s sanctioned weapons programs, authorities said. By routing their work through computers physically located in the United States, operatives could conceal that they were working abroad.

“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said in a statement.

The 187 devices seized in Texas included laptops and keyboard-video-mouse equipment, which can be used to control computers remotely. About 100 devices were recovered in North Texas, according to prosecutors.

CrowdStrike tracks the network under the moniker Famous Chollima and said its work with the FBI disrupted several U.S. laptop farms in late September. Organizations identified in the disrupted operations included businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering and government technology, the company said.

CrowdStrike described several ways operatives diverted employer-issued computers to the farms. Some filed false police reports claiming their laptops had been stolen so employers would ship replacements to different addresses. Others claimed last-minute moves or obtained jobs through staffing firms, allowing equipment to be redirected without those firms’ knowledge.

Once the computers arrived, facilitators installed hardware and software that enabled overseas workers to operate them, according to CrowdStrike. The company said operatives also disguised equipment used in the scheme to make it harder for security teams to detect.

The action adds to a series of federal investigations into North Korea’s use of fraudulent IT employment to raise money and gain access to sensitive information.

Last June, DOJ announced actions involving searches of 29 known or suspected laptop farms across 16 states. In one case, prosecutors alleged that an overseas worker accessed and stole export-controlled technical information from a California defense contractor developing artificial intelligence-powered equipment. A senior FBI official said at the time that at least one U.S. government contractor had been caught up in the fraudulent hiring schemes.

The schemes have reached direct federal hiring pipelines. In a case disclosed in May 2024 , participants tried to obtain contractor positions at Immigration and Customs Enforcement and the Federal Protective Service but could not meet fingerprinting requirements, according to an indictment. Another participant secured a contractor position at the General Services Administration but was terminated five days after an introductory meeting.

The latest seizures are unlikely to end broader DPRK operations. CrowdStrike said the disruptions would probably slow activity primarily in the areas where farms were shut down and were unlikely to have lasting effects, as operatives adapt their techniques to avoid detection.

The Justice Department said the investigation remains ongoing.

NEXT STORY: US Army to stage counter-drug training exercises in South America

mirsad sarajlic/Getty Images

执法人员在德克萨斯州开展打击欺诈性远程办公的行动中，查获了近 190 台笔记本电脑。

联邦检察官周二宣布，联邦调查局搜查了德克萨斯州 40 多处住宅，查获了 187 台笔记本电脑和其他设备，这些设备被用来帮助朝鲜特工以虚假身份在美国公司获得远程工作。

这项名为“孤星行动”（Operation Lonestar Roundup）的行动，目标是那些存放雇主配发电脑并允许海外工人远程访问的“笔记本电脑农场”。据美国司法部称，美国境内的中间人配置了这些设备，并将收益转移到朝鲜控制的账户。

为FBI行动提供情报和技术分析支持的CrowdStrike公司表示，此次行动涉及一项针对70多家美国公司的网络攻击活动，并在俄亥俄州逮捕了两人。该公司在向记者发布的声明中并未透露被捕者的身份或指控内容。司法部在德克萨斯州发布的声明中也未提及俄亥俄州的逮捕行动。

当局称，该计划使朝鲜工人能够访问企业系统，同时为朝鲜政权的武器计划创造收入。通过将工作路由到位于美国的计算机，这些特工可以掩盖他们在国外工作的事实。

“查获的每台笔记本电脑都可能代表一家雇佣了朝鲜IT人员的公司，”联邦调查局达拉斯分局负责人R·约瑟夫·罗斯罗克在一份声明中说。

德克萨斯州查获的187台设备包括笔记本电脑和键盘、视频和鼠标等远程控制电脑的设备。据检察官称，其中约100台设备是在德克萨斯州北部查获的。

CrowdStrike公司追踪到一个名为“Famous Chollima”的网络攻击网络，并表示其与美国联邦调查局（FBI）的合作在9月下旬捣毁了多个美国“笔记本电脑农场”。该公司称，被捣毁的组织涵盖航空航天、能源、金融服务、医疗保健、网络安全、国防工程和政府技术等多个行业。

CrowdStrike 描述了特工们将雇主配发的电脑转移到非法农场的几种方式。一些人谎称笔记本电脑被盗，并向警方提交虚假报案，以便雇主将替换电脑寄送到其他地址。另一些人则声称临时搬家或通过人力资源公司找到工作，从而在公司不知情的情况下将设备转移到农场。

据 CrowdStrike 公司称，电脑运抵后，相关人员安装了硬件和软件，使海外工人能够操作这些电脑。该公司表示，操作人员还对用于该计划的设备进行了伪装，以增加安全团队的侦查难度。

此次行动进一步加强了联邦政府对朝鲜利用虚假IT就业来筹集资金和获取敏感信息的一系列调查。

去年六月，美国司法部宣布对16个州的29个已知或疑似“笔记本电脑窝点”展开搜查行动。其中一起案件中，检方指控一名海外劳工从一家加州国防承包商处窃取了受出口管制的技术信息，该承包商正在开发人工智能设备。当时，一位联邦调查局高级官员表示，至少有一家美国政府承包商卷入了这种欺诈性招聘计划。

这些骗局已经渗透到联邦政府的直接招聘渠道。在2024年5月披露的一起案件中，根据起诉书，参与者试图在移民和海关执法局以及联邦保护局获得承包商职位，但未能满足指纹采集要求。另一名参与者在总务管理局获得了承包商职位，但在一次介绍性会议五天后就被解雇了。

最新查获行动不太可能终结朝鲜更广泛的非法活动。CrowdStrike公司表示，这些行动可能会主要减缓农场关闭地区的非法活动，而且不太可能产生持久影响，因为行动人员会调整策略以避免被发现。

司法部表示，调查仍在进行中。

下一篇报道：美国陆军将在南美洲举行禁毒训练演习