FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes.

Famous Chollima (a.k.a. WageMole) is commonly tracked as a North Korean threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime.

Because North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using stolen, rented, or fabricated identities.

In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrency and other assets.

As part of an operation in Texas codenamed “Lonestar Roundup,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.