The FBI says it worked with CrowdStrike to dismantle 40+ laptop farms across Texas used to help North Koreans get remote US tech jobs under stolen identities

U.S. companies now face increased scrutiny for their remote hiring practices and the onboarding processes that enable identity fraud.

The Department of Justice, in coordination with the FBI and CrowdStrike, has dismantled over 40 "laptop farms" in Texas used by North Korean nationals to facilitate a scheme generating millions in revenue. The operation, conducted between September 21-25, resulted in the seizure of 187 laptops and other devices. U.S. nationals Michael James Bostelle and Juan Cecilio Pena Carrillo were arrested and indicted on charges including wire fraud, money laundering, and identity theft for their alleged roles in helping North Koreans earn over $3 million from approximately 70 U.S. companies. These companies, spanning sectors like healthcare and cybersecurity, were tricked into hiring remote IT workers using stolen or purchased identities. The scheme has been active for at least eight years, with North Korea leveraging the funds for illicit purposes, including weapons development. This action is part of a broader, ongoing effort by U.S. law enforcement to disrupt such operations and identify American co-conspirators.

North Korea is evolving its tactics to circumvent detection, increasingly subcontracting entire IT jobs to freelancers in South Asia and West Africa and hiring facilitators for tasks like job applications and interviews. This move suggests a strategic adaptation to counter efforts by U.S. companies to identify North Korean workers, making it harder to trace the ultimate beneficiaries of the employment. The regime is also more aggressively seeking identities that qualify for U.S. government security clearances, posing a direct national security risk.

The scheme's sophistication is highlighted by North Koreans hiring U.S. citizens for a wider range of services, including appearing on camera for interviews, participating in meetings, verifying fraudulent identities, and even threatening companies and individuals. This multifaceted approach, which includes outsourcing work and using intermediaries for deception and intimidation, underscores the significant challenges law enforcement faces in combating these persistent cybercrime operations.