Security Operations

FBI shuts 40 North Korean laptop farms: how to spot fake remote hires

FBI raids shut 40+ North Korean laptop farms and 14 are charged. The FBI’s ‘identity in depth’ advice shows how SOC and HR can spot fake remote hires.

Radar graphic with the headline 'Laptop farms raided: hunt fake remote hires' and an insider threat label

US authorities have shut down more than 40 laptop farms in Texas and charged 14 people over a North Korean scheme that placed fake remote IT workers inside over 70 American companies. The FBI’s updated guidance gives any employer with remote technical staff a practical way to find the ones already inside.

What happened

On 13 October 2026 the US Department of Justice set out the results of a coordinated push against the North Korean remote IT worker operation. Between 21 and 25 September, FBI agents searched 40 residences across Texas under an operation named Lonestar Roundup. They seized about 187 laptops and KVM-over-IP devices that had been kept online so that operatives abroad could appear to be working from the United States.

Separately, an indictment brought in the Northern District of Ohio charges 14 people with conspiracy offences covering wire fraud, money laundering and identity theft, plus aggravated identity theft. Two US nationals have been arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Prosecutors say they hosted company laptops and helped workers obtain false identity documents. The other defendants are mostly China-based and remain at large. A third American, Trey Michael Nolte, is named but not charged; he allegedly ran Dark Falls LLC, a shell company posing as a software developer.

According to prosecutors, the activity began around 2019 and earned the workers roughly $3 million from more than 70 US employers. Those employers were in healthcare, cyber security, retail, manufacturing and communications. On the same day the FBI published a public service announcement, PSA261013, describing how the scheme has changed. CrowdStrike, which helped with the operation, published its own account of the group it tracks as Famous Chollima.

The technical picture

The scheme depends on a domestic footprint. A worker hired under a stolen identity needs the employer’s laptop to arrive somewhere plausible and connect from a residential IP address that passes geolocation checks. Paid facilitators provide that, installing remote access tooling so the real operator can work from overseas.

CrowdStrike lists several tricks used to divert hardware to these farms. Operatives file false police reports about stolen laptops so that replacements go to a new address. They also rotate addresses and claim last-minute moves. Some got in through IT staffing firms, which let client laptops be quietly redirected. Since May 2026 the group has spoofed device identifiers, for example making a video capture card look like a webcam to endpoint tooling. CrowdStrike also saw the same disguised device identifier reused across different victim organisations.

The FBI’s tooling list will be familiar to anyone who works in a SOC. It includes AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop, as well as general RMM agents. Hardware KVM units such as TinyPilot, PiKVM and GL.iNet appear too, as does OBS Studio with the VDO.Ninja plugin. The Bureau says most operatives must record their screens to log their work, so data almost always leaves. In practice, it leaves the estate as video.

The operation is also spreading the work out. The FBI says operators now run more farms, each holding fewer laptops, so that one raid does less damage. Some subcontract the day job to freelancers, usually in Pakistan, India or Nigeria. After dismissal, some have threatened to leak data or made threats of violence against former managers.

Checklist of five warning signs of a fraudulent North Korean remote IT worker: remote access tools, KVM hardware, location mismatch, shipping tricks and identity churn

Why it matters for UK organisations

The victims named in this case are American, and nothing in the material released so far points to UK employers. That should not reassure anyone. CrowdStrike describes the group as sector-agnostic: any organisation offering remote work is a potential source of revenue. The FBI says the operation targets western companies generally. One common cover story, an Eastern European displaced by the war in Ukraine, would not look out of place in a UK hiring pipeline.

UK firms rely heavily on remote contractors, offshore development partners and staffing agencies. That is the same supply route CrowdStrike says operatives used to get devices redirected. Right-to-work and background checks help, but the FBI notes that operatives buy access to identity verification services to test that stolen details will pass screening before they apply. A clean vetting report is therefore weak evidence on its own. If UK wages end up funding a sanctioned regime, the board will want legal advice early.

Expert view

I think the most useful idea in this announcement is the FBI’s phrase “identity in depth”. It applies an idea defenders already accept to a problem most organisations still leave to HR. No single signal reliably exposes one of these workers. AnyDesk use, odd-hours logins or changed bank details may each be innocent; together they form a pattern worth investigating. The FBI is also candid about false positives. Crude filtering by nationality or name lists would hurt genuine candidates, including identity theft victims.

When we test organisations, endpoint visibility on contractor laptops is often thinner than on staff devices, and unapproved remote access tools tend to survive for months. Some detection logic is simple, such as a corporate laptop whose USB inventory shows a KVM device. The difficult part is getting HR, procurement and the SOC to share what they each know. The FBI makes the same point about cross-functional working.

I also agree with CrowdStrike’s own assessment that the raids will slow the group only locally. The farms will move, and the device spoofing shows the operators are adapting to defenders. Organisations should treat this as an ongoing insider threat, not a single news event.

What to do now

  1. Block unapproved remote access tools. Use application control to block AnyDesk, RustDesk, Chrome Remote Desktop and similar tools unless they are approved, and alert when they appear. This is the Cyber Essentials secure configuration and malware protection controls in practice.
  2. Hunt for KVM and capture hardware. Review USB and HID device inventories on remote and contractor endpoints for KVM-over-IP units and for capture cards presenting as webcams.
  3. Correlate identity signals. Flag logins whose location or time zone does not match the declared location, shipping addresses that differ from home addresses, and frequent changes to bank details.
  4. Tighten device logistics. Ship hardware only to verified addresses, treat “stolen laptop” replacement requests as security events, and require staffing firms to confirm where client devices actually are.
  5. Verify live, more than once. Use live video identity checks at hiring and again during employment. Compare faces with documents and check profiles for recent creation.
  6. Apply least privilege to new remote hires. Limit access to sensitive data and production systems until trust is established, in line with the Cyber Essentials user access control requirement.
  7. Prepare an exit plan. If you suspect a fraudulent hire, involve legal and security before you dismiss them. Revoke access in a single coordinated step, and prepare for extortion attempts.

Bottom line

Lonestar Roundup removed a large slice of one region’s infrastructure, but the FBI’s own advice shows that North Korean IT workers are a moving target. Any UK organisation that hires remote technical staff should treat hiring and onboarding as part of its attack surface. Join up the signals from HR, IT and the SOC, and look for the patterns now, before a worker is already in place.

Sources

Related Posts