U.S. Charges 14 and Dismantles 40+ Laptop Farms in North Korean IT Worker Scheme
Summary
The U.S. charged 14 people and seized about 187 computers in a disruption of North Korean IT worker fraud alleged to have affected over 70 companies and generated about $3 million.
Key points
- The alleged scheme ran from around 2019 to July 2025, using fake identities to place North Korean IT workers in jobs at U.S. and other companies.
- Facilitators allegedly hosted company laptops in the U.S., enabled remote access, and helped move payments through U.S. bank and money-transfer accounts.
- Authorities dismantled more than 40 laptop farms in Texas and seized about 187 computers; two U.S. nationals were arrested, while the other defendants remain at large.
- The operation is also tracked as Famous Chollima, purpledelta, and Wagemole; the indictment alleges revenue was funneled to North Korea in violation of sanctions.
- CrowdStrike reported tactics including false stolen-laptop reports, shipment diversions, rotating host addresses, and spoofing device hashes to evade detection.
- The FBI said workers increasingly subcontract jobs to freelancers, and reported threats of physical violence against former managers and their families.
- CrowdStrike assessed that the disruption may have only short-term, local effects as the operation adapts.
Article Details
- Event Type
- U.S. law-enforcement disruption and criminal charges targeting a North Korean remote IT worker fraud scheme.
- Impact
- The indictment charges 14 people in a scheme alleged to have affected more than 70 U.S. companies and generated approximately $3 million for IT workers. Authorities seized about 187 computers and dismantled more than 40 laptop farms in Texas. The FBI also reported threats of physical violence against former managers and their families.
People
BostelleOne of the two U.S. nationals charged who had been arrested; the article gives no first name.CarrilloOne of the two U.S. nationals charged who had been arrested; the article gives no first name.David M. ToepferU.S. Attorney for the Northern District of Ohio, quoted on the threat posed by nation-states.Trey Michael NolteU.S.-based co-conspirator named in the indictment but not charged; alleged to have managed Dark Falls LLC.
Threat Actors
Vendors
Countries
Indiasaid. "ITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries."Nigeriasubcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries."North KoreaThe U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme.Pakistanthe FBI said. "ITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries."
Industries
communications"Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies," the U.S. Department of Justice (DoJ) said.Healthcare"Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies," the U.S. Department of Justice (DoJ) said.Manufacturing"Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies," the U.S. Department of Justice (DoJ) said.Retail"Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies," the U.S. Department of Justice (DoJ) said.