cyber.hendryadrian.com
Security News · securityweek.com

US Arrests Two in Operation Targeting North Korean IT Worker Laptop Farms

· Original article ↗

Summary

Two US nationals were arrested over an alleged scheme that helped North Korean IT workers obtain jobs at more than 70 US companies. A separate FBI operation searched 40 Texas locations and seized 187 laptops and KVM devices.

Key points

  • The indictment alleges the scheme ran from 2019 to July 2025 and generated more than $3 million in fraudulent revenue.
  • US facilitators allegedly housed and configured company-issued laptops so overseas workers could appear to work from the United States.
  • The workers allegedly used fake IDs and VPN and proxy infrastructure to conceal their locations and secure jobs at more than 70 US companies.
  • The indictment also names ten China-based participants.
  • In a separate operation, the FBI searched 40 suspected laptop-farm locations in Texas and seized 187 laptops and KVM devices.
  • CrowdStrike tracks the scheme as Famous Chollima and says operators have adapted by hiding remote-access tools and spoofing device identifiers.
  • The FBI recommends layered access controls and continuous identity verification throughout employment to help detect fraudulent workers.

Article Details

Event Type
US law enforcement operation and arrests targeting a fraudulent North Korean IT worker scheme involving laptop farms.
Impact
Two US nationals were arrested and charged with allegedly facilitating fraudulent remote employment for North Korean IT workers. The indictment alleges the scheme generated more than $3 million and helped workers obtain positions at over 70 US companies. Authorities also searched 40 locations in Texas and seized 187 laptops and KVM devices. CrowdStrike assessed that disrupting laptop farms may have limited impact on the broader scheme.

People

Han Guo BinChina-based individual charged with participating in the alleged scheme.Jin LongChina-based individual charged with participating in the alleged scheme.Juan Cecilio Pena CarrilloTexas resident arrested and charged with allegedly helping North Korean IT workers obtain fraudulent remote employment.Michael James BostellePennsylvania resident arrested and charged with allegedly helping North Korean IT workers obtain fraudulent remote employment.Pei Li GuangChina-based individual charged with participating in the alleged scheme.Sheng Zhang KunChina-based individual charged with participating in the alleged scheme.Sun Sheng MingChina-based individual charged with participating in the alleged scheme.Wang Jian JunChina-based individual charged with participating in the alleged scheme.Weng Shou ChengChina-based individual charged with participating in the alleged scheme.Yu YangChina-based individual charged with participating in the alleged scheme.Zhang Li PingChina-based individual charged with participating in the alleged scheme.Zhang Wei PingChina-based individual charged with participating in the alleged scheme.

Threat Actors

Famous ChollimaCrowdStrike's name for the North Korean IT worker scheme and its operatives, which use deception and laptop farms to obtain fraudulent remote employment.

Vendors

CrowdStrikeAccording to CrowdStrike, which tracks the fake IT worker scheme as Famous Chollima, operatives abroad employ various deception techniques to convince employers to ship company-issued laptops to farm locations.

Countries

ChinaThe indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long for participating in the scheme.North KoreaRelated: North Korea Suspected in $351 Million Bitget Crypto Heist

Industries

Aerospaceidentified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, andcommunicationslocations, the ITWs, aided by US facilitators, obtained employment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.consumer technologyfinancial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology,” CrowdStrike notes.defense engineeringspan critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology,” CrowdStrike notes.Energyidentified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumerFinancial Servicesacross the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology,”government technologyincluding aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology,” CrowdStrike notes.Healthcareby US facilitators, obtained employment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.Manufacturingobtained employment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.Retailemployment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.

Related Articles