Threat intel
North Korean laptop farms: how an employer spots one
FBI raids 40+ Texas laptop farms and two Americans are arrested over North Korean IT workers at 70+ US firms. How to catch one at hiring, shipping and on the endpoint.
On October 13 the US Department of Justice (DOJ) unsealed an indictment in the Northern District of Ohio charging 14 people over a North Korean remote IT worker scheme. Two Americans were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten defendants are based in China and two remain under seal. The charges are wire fraud, money laundering and identity theft. Prosecutors allege that from 2019 to about July 2025, North Korean workers using stolen or fabricated identities held remote jobs at more than 70 US companies in 17 states and the District of Columbia, and that about $3 million in pay went to accounts North Korea controls. These are allegations, not convictions.
In the same announcement the FBI said it had searched more than 40 homes in Texas suspected of being laptop farms between September 21 and 25, in what it calls Operation Lonestar Roundup, and seized about 187 laptops and KVM (keyboard, video, mouse) devices. If you hire remote engineers, support staff or contractors and ship them a company laptop, this is a fraud aimed at your hiring process and your endpoint fleet, and the FBI has published what to look for.
How it works
The worker cannot be in the US, so the scheme rents a US footprint. CrowdStrike, which helped the FBI and tracks the operators as Famous Chollima, describes the farm as solving three problems a worker abroad cannot: receiving and setting up hardware, getting past geolocation fraud controls, and passing identity checks that need a US address and bank account.
Hiring comes first. The FBI's public service announcement (PSA) of October 13 says most of the names and addresses these workers give employers belong to other people. The operators pay Americans, often people under financial strain, to sit interviews, appear on camera, verify identities, lend their online accounts, ship packages and even provide urine samples or fingerprints. In this case, prosecutors allege Bostelle supplied his name and a fraudulent driver's license so a worker could be hired, and Pena Carrillo hosted laptops at his home under various names.
Once the worker is hired, the employer ships a laptop. CrowdStrike lists the tricks used to send it to a farm instead of the name on the contract: a last-minute relocation, rotating residential addresses, a false police report claiming the laptop was stolen so a replacement goes to a new address, and hiring through IT staffing firms so the end client's device is redirected without the firm noticing.
At the farm, the host keeps the laptop powered and online. Either they install remote-access software (the FBI names AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop Streamer, plus remote monitoring and management tools), or they plug in a KVM-over-IP device such as PiKVM, TinyPilot or a GL.iNet unit. A KVM-over-IP box takes the laptop's video output and presents itself as a USB keyboard and mouse, then streams both over the internet. No remote-access software runs on the laptop, so the endpoint agent only records an extra display and an extra keyboard and mouse. Traffic leaves from an ordinary US home connection, which is what the geolocation check expects to see.
What attackers are doing
The pay is the main goal: the FBI says North Korea's government receives an estimated 85 to 90 percent of what these workers earn. It is not the only harm. According to the PSA, some workers who got jobs with access to personal data took that data, and in isolated cases tried to extort the people it belonged to. After being fired, workers have threatened to leak company data unless paid, and former managers and their families have received death threats.
The operators are adapting to detection. CrowdStrike says that since May 2026 they have spoofed device identifiers, for example making a video capture card appear as a webcam, and reused the same disguised device across several victim organisations. It also saw attempts to hide remote management tools after earlier public reporting. It calls the targeting sector-agnostic: victims in its clusters run from healthcare and financial services to aerospace and defence engineering. CrowdStrike expects the Texas seizures to slow activity mainly where farms were shut down.
What to do
The FBI's advice is "identity in depth": no single check catches this, so combine weak signals and keep verifying after the hire.
At hiring
Do at least one live identity check where the candidate holds the document on camera, and compare the face with the photo. The FBI suggests E-Verify and asking for a passport or more than one form of ID. CrowdStrike adds signals a recruiter can check in a few minutes: the same phone number, email address or resume text across several profiles, LinkedIn or GitHub accounts created recently, and references who turn out to be other personas.
Before the laptop ships
Ship only to the address verified during background and employment checks. Treat a change of shipping address after the offer, a sudden relocation, or a request to replace a "stolen" laptop at a different address as a reason to pause and re-verify the person on video.
On the endpoint
Search your endpoint detection and response (EDR) or device management inventory for remote-access tools that are not on your approved list, by process and installed-application name: AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer and any RMM agent your IT team did not deploy. The FBI also lists OBS Studio with the VDO.Ninja plugin, and Homebrew where the role does not need it. For KVM-over-IP, review USB device connection events and display changes: a second keyboard and mouse that appear together with a new external display on a laptop that should be used on its own is worth a question. Identifiers can be spoofed, so look for the combination rather than one vendor string.
On the network and in HR systems
Check sign-in logs in your identity provider for commercial VPN egress (CrowdStrike names Astrill VPN), working hours that fit a different time zone from the stated home, and several employees whose devices sign in from the same residential IP address. In payroll, flag frequent bank account changes and accounts at banks that issue multiple virtual account numbers. The FBI also flags screen recordings stored outside your control, which amount to data exfiltration.
If you think you have one
Plan the exit before you act. Revoke the person's sessions, tokens and VPN access at the same time as, or before, they are told; former workers have threatened managers and tried extortion. Preserve the endpoint and identity logs, recover the device, and report to your local FBI field office and at ic3.gov with addresses, account names, email addresses, bank accounts and IP addresses. Then review what the account could reach and rotate any secrets it held, such as API keys, repository tokens and cloud credentials.
The wider lesson
Most onboarding checks identity once, at the offer, and paid stand-ins get this scheme through that check. Shipping addresses, endpoint software and USB inventory, and sign-in locations are already logged in most companies, but they sit with HR, IT and security separately. A short review in a new hire's first weeks that puts those three records side by side covers most of the indicators the FBI and CrowdStrike list.
Our security operations team builds detections for exactly this mix of signals across EDR, identity and HR data, and our safeguarding and hardening work locks down which remote-access tools and USB devices company laptops accept. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Help Net Security, US Department of Justice, US Attorney, Northern District of Ohio, FBI IC3 PSA, CrowdStrike, CyberScoop, Cybersecurity Dive, BleepingComputer.