How do defenders detect North Korean laptop farm fraud?

The Department of Justice disrupted multiple laptop farms across Texas in late September, targeting residences used by North Korean nationals to facilitate remote work fraud. Law enforcement seized 187 laptops and other devices during raids on more than 40 locations between September 21 and 25.

Prosecutors say the scheme earned over $3 million from approximately 70 US companies across 17 states. The victims span healthcare, cybersecurity, retail, and manufacturing sectors. The operation relied on tricking US employers into hiring remote workers using stolen or purchased identities.

Operational mechanics

Michael James Bostelle and Juan Cecilio Pena Carrillo were arrested and indicted on wire fraud, money laundering, and identity theft charges. They allegedly helped North Korean workers obtain fake identification documents to secure employment and verify bank accounts. Trey Michael Nolte, who ran a shell company facilitating the scheme, was not charged.

SecurityWeek reports that the FBI conducted searches under Operation Lonestar Roundup. The seized equipment included KVM devices used to manage multiple remote connections. These tools allowed operatives abroad to control US-issued hardware while masking their true geographic location.

Affected environments

The fraud scheme operated between 2019 and July 2025, according to the indictment. CrowdStrike tracks this activity under the name Famous Chollima. The group targets organizations that ship company-issued laptops to remote employees without rigorous physical verification of the device location.

CrowdStrike notes that operatives use deception techniques like filing fraudulent police reports for stolen laptops to obtain replacements. They also claim sudden relocation to divert shipments or rotate through multiple residential addresses. This allows them to redirect end-client devices to centralized farm locations.

Next steps

The DOJ did not confirm if the arrests were directly linked to the Texas raids. Several Chinese and North Korean nationals were also indicted for their roles in the scheme. No software patch or configuration fix has been confirmed to prevent this type of physical access fraud.

Signals worth monitoring

Security teams should review logs for anomalous remote access patterns from devices registered in unexpected geographic locations. Check whether device identifiers match known hardware profiles or if multiple personas share the same MAC address. Look for sudden changes in shipping addresses or repeated claims of lost hardware. Verify that remote workers are accessing systems from consistent network environments rather than rotating through residential IPs.

What to do and how to stay safe: North Korea

• Verify the physical location of remote workers through video calls or local support checks before shipping hardware.
• Monitor for duplicate device identifiers across different employee accounts or contractors in your directory.
• Review shipping logs for frequent address changes or redirections to residential areas not associated with the employee.
• Ensure that remote access tools are not being used to mask the true origin of network connections.

Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who was arrested in the North Korean laptop farm raids?

Michael James Bostelle and Juan Cecilio Pena Carrillo were arrested and indicted for facilitating the scheme.

How much revenue did the scheme generate?

The scheme generated over $3 million in fraudulent revenue from US companies.

What equipment was seized during the raids?

Law enforcement seized 187 laptops and KVM devices from more than 40 residences in Texas.