Ethical Hacking News
A recent operation by the FBI has exposed a sophisticated scheme used by North Korean intelligence agents to earn millions of dollars by impersonating remote IT workers. The scheme, which targeted over 70 US companies across 17 states, generated approximately $3 million in revenue for the North Korean regime. The operation highlights the growing threat posed by North Korean IT workers and the need for US companies to be vigilant in their hiring practices and implement robust security measures to protect themselves against insider threats.
The Operation Lonestar Roundup exposed a scheme by North Korean intelligence agents to impersonate remote IT workers, generating $3 million in revenue for the North Korean regime.The scheme involved North Korean IT workers using stolen or fake identities, VPNs, and proxy servers to pose as legitimate remote workers.The operation targeted over 70 US companies across 17 states and involved 40 Texas homes, with 187 laptops and KVM switch devices seized.The scheme was part of a broader effort by North Korea to fund its regime through remote IT work for US companies.The FBI warned US companies to remain vigilant in their hiring practices and to be aware of red flags associated with North Korean IT worker applications.The operation is part of a growing concern about the use of remote work arrangements by North Korean agents, with North Korean hackers responsible for about half of all documented hands-on cyber intrusions over the past year.
The recent Operation Lonestar Roundup, conducted by the FBI, has exposed a sophisticated scheme used by North Korean intelligence agents to earn millions of dollars by impersonating remote IT workers. The scheme, which targeted over 70 US companies across 17 states, generated approximately $3 million in revenue for the North Korean regime.
According to the Department of Justice (DoJ), the scheme involved North Korean IT workers applying for remote jobs using stolen or fake identities. They used Virtual Private Networks (VPNs) and proxy servers to make it appear as though they were working from the United States. Meanwhile, American helpers received laptops provided by employers and installed remote access software, allowing the North Korean workers to use them. These helpers were paid for their role, while the money earned from the jobs was sent back to North Korea through accounts controlled by the regime.
The scheme was simple yet effective, with the North Korean agents using fake identities and technical tools to create the illusion of legitimacy. The operation, which took place between September 21 and 25, involved 40 Texas homes and the seizure of approximately 187 laptops and KVM switch devices.
The DoJ stated that the scheme was part of a broader effort by North Korea to fund its regime through remote information technology work for US companies. The operation was carried out by a group known as FAMOUS CHOLLIMA, which CrowdStrike, a cybersecurity firm, described as a "laptop farm" infrastructure.
"This operation enables FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations," CrowdStrike stated.
The scheme is believed to have targeted companies in the healthcare, communications, cybersecurity support, retail, and manufacturing sectors across Ohio, 16 additional states, and the District of Columbia. The companies were unknowingly providing laptops and remote access software to the North Korean agents, who used them to earn money while pretending to work for legitimate companies.
The operation is also part of a broader U.S. law enforcement effort to dismantle FAMOUS CHOLLIMA's US infrastructure. CrowdStrike's Counter Adversary Operations team will remain an integral part of this effort.
The FBI's public service announcement warns US companies to remain vigilant in their hiring practices and to be aware of the red flags associated with North Korean IT worker applications. The red flags include inconsistencies in work history, reluctance to appear on video, requests to redirect laptop deliveries, and payment accounts that route through intermediaries.
The scheme is also a stark reminder of the threats posed by nation-states like North Korea, which will go to great lengths to exploit a nation's economic strength to further and fuel their own nefarious agendas.
The DoJ released a list of email addresses used in these operations, including accounts like and , which companies can add to their screening indicators.
The FBI also issued a public service announcement, which stated that "thousands of North Korean state-controlled IT workers" are currently embedded at Western companies, posing a significant national security and intellectual property theft insider threat.
In addition to the Operation Lonestar Roundup, the DoJ has announced several other enforcement actions against North Korean IT workers and entities since June 2025. These actions include indictments, arrests, and searches of suspected "laptop farms" in Texas.
The operation is part of a growing concern about the use of remote work arrangements by North Korean agents. According to CrowdStrike, North Korean hackers were responsible for about half of all documented hands-on cyber intrusions over the past year.
The scheme is also a reminder of the need for US companies to be vigilant in their hiring practices and to implement robust security measures to protect themselves against insider threats.
Related Information:
https://www.ethicalhackingnews.com/articles/North-Korean-Intelligence-Agents-3-Million-Scheme-A-Threat-to-US-Companies-ehn.shtml
https://securityaffairs.com/201193/intelligence/north-korean-it-workers-used-stolen-us-identities-to-earn-3-million.html
Published: Sat Oct 17 12:14:21 2026 by llama3.2 3B Q4_K_M
