The FBI recently seized nearly 200 laptops and other devices used in North Korean remote IT-worker scams during raids on more than 40 residents in Texas, authorities announced on Tuesday.
In tandem with the seizures, federal prosecutors charged 14 people who allegedly helped North Korea run its operations from the U.S., including by operating laptop farms that enabled Pyongyang’s overseas operatives to pretend to be U.S.-based employees of victim companies. Two of those people, a Pennsylvania resident and a Texas resident, have been arrested.
North Korea’s IT worker schemes help fund the nation’s weapons programs and “threaten the security of the IT systems and data of the deceived U.S. employers,” Assistant Attorney General for National Security John Eisenberg said in a statement. Law enforcement officials “will use every available tool to track down anyone assisting [North Korea] and to protect our national security,” he added.
A partially unsealed indictment charges the two Americans, 10 China-based associates and two people whose names remain under seal with offenses related to wire fraud, money laundering and identity theft. It describes a roughly six-year-long operation, beginning in 2019, to help foreign workers employed by North Korea deceive U.S. companies during hiring processes, access those companies’ networks and data, receive salary payments and transfer those payments to overseas accounts.
According to the indictment, the operation constituted “a massive fraud that impacted more than 70 U.S. companies, compromised the identities of more than 25 U.S. persons, caused false information to be conveyed to DHS, IRS, and SSA on dozens of occasions, generated approximately $3 million in revenue for the overseas IT workers, and caused U.S. victim companies to incur legal fees, computer network remediation costs, and other damages and losses of at least $3 million.”
Victim companies operated in multiple industries and were located in at least 17 states and the District of Columbia, prosecutors said.
The FBI on Tuesday published an advisory about North Korea’s remote IT worker schemes that includes information about how businesses can spot them. CrowdStrike, which partnered with the government on the operation, published a blog post about the North Korean threat actor behind the schemes, which it calls “Famous Chollima.”
Long-running campaign to thwart North Korean schemes
The latest laptop seizures, which took place between Sept. 21 and Sept. 25, were dubbed “Operation Lonestar Roundup” and are part of a broader Department of Justice program called the DPRK RevGen: Domestic Enabler Initiative. Last November, five U.S.-based facilitators of North Korean scams pleaded guilty; more recently, four convicted facilitators received prison sentences ranging from 18 months to 108 months.
“Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability,” Ryan Raybould, the U.S. attorney for the Northern District of Texas, said in a statement.
