North Korean IT worker infiltration schemes

U.S. authorities, including the FBI and Department of Justice, conducted “Operation Lonestar Roundup” to disrupt North Korean “laptop farms” used to infiltrate American companies. Between September 21 and 25, investigators searched over 40 locations in Texas, seizing approximately 187 laptops and electronic control devices. Prosecutors allege that North Korean operatives used stolen or forged identities to secure remote positions at more than 70 U.S. companies, generating roughly $3 million to fund sanctioned North Korean nuclear weapons development.

Local accomplices facilitated these schemes by receiving company equipment and transferring salaries to North Korean-controlled accounts. The investigation led to indictments against 14 individuals, including two U.S. citizens.

The scope of the activity appears to be global. In South Korea, police are investigating the first known case of North Korean IT personnel concealing their identities to work for private domestic enterprises. International alerts regarding these identity theft and cyber espionage tactics have been issued to several countries, including the U.S., Japan, the UK, and Australia.