FBI Shuts Down 40 Laptop Farms in $3 Million North Korean Employment Fraud Scheme

FBI Shuts Down 40 Laptop Farms in $3 Million North Korean Employment Fraud Scheme

The US Federal Bureau of Investigation (FBI) has dismantled 40 laptop farms allegedly used to support a North Korean operation that secured remote IT jobs through fake identities. Authorities seized 187 computer devices and arrested two individuals in a crackdown targeting a scheme believed to have generated more than $3 million in revenue.

The operation, known as Famous Chollima, involved North Korean IT workers applying for remote positions at American companies using stolen or fabricated identity documents. The workers relied on virtual private networks (VPNs), proxy infrastructure, and fraudulent online accounts to make it appear that they were working from within the United States.

How the Laptop Farm Scheme Worked

According to the investigation, US-based accomplices helped the operation by receiving company-issued laptops on behalf of fraudulent employees. These individuals housed and configured the devices, installed remote-access software, and enabled overseas workers to operate them remotely.

The scheme allowed North Korean operatives to maintain the appearance of legitimate US-based employment while concealing their actual locations.

Money earned through these jobs was reportedly transferred to accounts controlled by the North Korean government or entities associated with it. Authorities said the proceeds supported sanctioned interests, including programs linked to weapons development, ballistic missiles, intelligence, and nuclear capabilities.

The fraudulent operation targeted organizations across several industries, including healthcare, telecommunications, cybersecurity support, retail, and manufacturing.

Arrests and International Investigation

The FBI’s Operation Lonestar Roundup resulted in the seizure of 187 devices and the closure of 40 laptop farms. US nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested in connection with the scheme. Another dozen individuals based in China were charged.

Investigators said the operation relied on a network of intermediaries and fraudulent online accounts to help conceal the identities and locations of the workers.

The FBI worked with cybersecurity company CrowdStrike to investigate and disrupt the network.

Deception Tactics Used to Avoid Detection

Investigators identified several methods allegedly used to keep the operation running. Some individuals filed false police reports claiming that company-issued laptops had been stolen, prompting employers to send replacement devices to addresses connected to the laptop farms.

Others repeatedly changed residential addresses to obscure the devices’ destinations. Some operatives reportedly claimed they needed to relocate unexpectedly, allowing them to redirect laptops while the equipment was being shipped.

In other cases, staffing agencies were used to secure positions. This enabled company devices to be diverted to laptop farms without the staffing firms necessarily knowing what was happening.

Earlier investigations by Huntress also identified North Korean operatives connected to Famous Chollima who were reportedly applying for as many as 60 jobs per day.

Warning for Employers

The FBI has encouraged employers to review indicators published by the US Department of Justice to help identify suspicious job applications and potential North Korean IT worker activity.

The case demonstrates how employment fraud can create risks beyond financial losses. Fraudulently hired workers may gain access to company networks, confidential information, internal systems, and sensitive business operations.

Authorities have emphasized that disrupting these laptop farms also cuts off a source of revenue allegedly used to support North Korea’s government programs.

Conclusion

The dismantling of 40 laptop farms highlights the growing challenge of detecting sophisticated employment fraud in remote-working environments. Organizations should strengthen identity verification, examine unusual device-shipping requests, monitor remote-access activity, and establish clear procedures for distributing company equipment.

As remote hiring continues to expand, businesses must ensure that their recruitment and onboarding processes are strong enough to identify fraudulent applicants before they gain access to corporate systems.