DoJ Disrupts Famous Chollima DPRK IT Worker Scheme, Seizes Nearly 187 Laptops in Texas Raids

What happened

The U.S. Department of Justice has disrupted operations tied to the Famous Chollima threat group, arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops linked to North Korean remote IT worker schemes operating out of Texas, according to BleepingComputer.

Why it matters for defenders

These "laptop farm" operations place North Korean IT workers into legitimate remote jobs at Western companies using stolen or fabricated identities, often with the help of U.S.-based facilitators who host company-issued laptops locally to disguise the workers' true location. The resulting income has historically been used to fund DPRK state programs, and the access gained through these roles creates insider-threat exposure for employers — including potential data theft, espionage, or further compromise. Any organization with remote-first hiring, especially in tech and IT contracting, is a potential target.

What defenders should watch for now

• Review remote-hire onboarding for red flags: reluctance to appear on video, inconsistent timezone/behavioral patterns, shared or forwarded shipping addresses for equipment, and use of VPNs/proxies to mask location.
• Monitor for company laptops showing persistent remote-access tooling (KVM-over-IP devices, remote desktop software) that would allow a third party to operate the device from elsewhere.
• Audit identity verification processes for new hires and contractors, particularly document authenticity checks and payment routing to third parties.
• Flag multiple employees/contractors sharing the same residential address, bank account, or device-shipping address — a hallmark of laptop farm operations.
• Review HR and IT provisioning logs for anomalies consistent with identity-sharing or proxy employment.

Developing story

Details on the scope of charges, specific companies affected, and further enforcement actions are still emerging. This is net-new intelligence from a law enforcement action rather than a technical vulnerability disclosure. For the full report, see the original coverage at BleepingComputer.