U.S. Takes Down 40+ Laptop Farms, Charges 14 in North Korean IT Worker Scheme

The U.S. Department of Justice charged 14 people and seized about 187 computers on Tuesday as part of its ongoing campaign against a fraudulent scheme in which North Korean IT workers landed remote jobs at Western firms.

The defendants include U.S. citizens and Chinese nationals, facing counts of wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. The scheme hit more than 70 U.S. companies and ran from roughly 2019 until July 2025. Two Americans, Carrillo and Bostelle, have been arrested; the others remain at large. A third U.S. national, Trey Michael Nolte, is named in the indictment but not charged: prosecutors say he ran a shell company, Dark Falls LLC, that claimed to offer software development but existed to further the fraud.

Laptop farms and fake identities

Raids from September 21 to 25, 2026, dismantled more than 40 so-called laptop farms across Texas. The operation — tracked as Famous Chollima, purpledelta and Wagemole — relies on North Koreans getting hired under false or stolen identities and funneling part of their salaries back to the regime, in breach of sanctions and to fund its nuclear and military programs. U.S. facilitators host company-issued laptops, set up remote access and open bank accounts to make overseas workers look domestic, collecting a fee in return. In all, the scheme generated about $3 million, and victims spanned healthcare, communications, retail and manufacturing firms nationwide.

According to CrowdStrike, the operatives reroute hardware to the farms with some creativity: filing bogus theft reports to trigger replacement shipments, rotating through addresses, and citing sudden relocations. Since May 2026 they have also spoofed device hashes — for instance, making a video capture card appear as a webcam. A farm, analysts note, serves as a "rented U.S. footprint" to satisfy know-your-customer checks. Shutting down individual farms, they add, will only slow the operation briefly.

Evolving tactics

In a separate alert, the FBI said North Koreans increasingly subcontract the actual work to freelancers in South Asia and West Africa — Pakistan, India, Nigeria — paying them a fraction of the salary. The same freelancers help apply to openings en masse and sit interviews. The actors use facilitators' identities without consent, recruit economically vulnerable Americans, and spin elaborate cover stories (such as posing as refugees from the war in Ukraine) while hijacking others' social and professional profiles. A newly alarming trend: threats of violence against former managers and their families. A particular target is roles needing security clearances, cleared defense contractors, and service members asked to host laptops.

Source: The Hacker News