US authorities dismantle North Korean remote IT worker laptop farms
The U.S. Justice Department disrupted the Famous Chollima group by arresting two people, charging 14, and seizing about 187 laptops in Texas. The operation targeted laptop farms where employer-issued machines were hosted so North Korean remote IT workers could appear to be in the United States. CrowdStrike said the operatives used fake theft reports, address changes, and shipment diversions, while a separate Ohio indictment described a scheme that affected 70 companies and earned about $3 million.
The Justice Department moved against Famous Chollima, also called WageMole, a North Korean-linked group accused of using fraudulent remote IT jobs to raise money for the DPRK. In Texas, the FBI’s “Lonestar Roundup” searched 40 residences from September 21 to 25 and seized about 187 laptops plus KVM input devices.
CrowdStrike, which tracked the activity since April 2025, said operatives allegedly used false theft reports, rotating addresses, last-minute relocation claims, and staffing access to divert employer laptops. A separate Ohio indictment covered 2019 to July 2025, naming 70 affected companies and roughly $3 million in proceeds. Two U.S. nationals were arrested; 12 Chinese defendants were charged separately.
The disruption could reduce some fraudulent remote-work channels, potentially making it harder for sanctioned North Korean operators to earn revenue and access employer systems. Companies that hire remote staff may face continued pressure to verify identities, locations, and device shipments. Workers and legitimate remote applicants could encounter stricter screening, while affected firms may review security and payment controls. The broader effect may depend on whether similar laptop-farm infrastructure persists or shifts elsewhere.