The US Department of Justice announced on 13 October coordinated actions against networks of North Korean IT workers employed remotely by American companies. The reported tally: 14 people charged, two arrests and around 187 devices seized. According to the authorities, these networks used stolen identities and relays set up on American soil to generate revenue for Pyongyang. The charges have yet to be proven in court and the defendants are presumed innocent.

How the fraud works, according to the indictment

The first part of the case is being heard in Ohio. According to the indictment, the scheme allegedly operated from 2019 until around July 2025. The principle, as prosecutors describe it, comes down to a few steps:

  • Recruitment: North Korean IT workers apply for remote jobs using stolen or fabricated identity documents.
  • Network camouflage: VPNs and proxy infrastructure make them appear to be workers based in the United States.
  • Physical relays: American intermediaries receive the laptops sent by employers and configure them so they can be controlled remotely. These home setups are nicknamed “laptop farms”.
  • Payment: the same facilitators allegedly helped transfer salaries to accounts controlled by North Korea.

Again according to prosecutors, this scheme brought in around 3 million dollars, the alleged recipients of which were sanctioned entities linked to the regime. More than 70 employers are affected, in healthcare, communications, IT support, retail and manufacturing. They are located in Ohio, in sixteen other states and in the District of Columbia.

Two US nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, have been arrested. The indictment also targets ten people based in China and two others whose identities remain confidential. The charges include wire fraud, money laundering and identity theft.

In Texas, the FBI goes after laptop “farms”

The second part, dubbed Operation Lonestar Roundup, took place from 21 to 25 September. The FBI carried out searches and other actions at more than 40 Texas residences known or suspected to host setups used by North Korean workers. Agents seized around 187 devices: laptops, but also KVM switches, which allow several machines to be controlled remotely. The figure therefore does not refer to computers alone.

The cybersecurity company CrowdStrike, which worked with investigators, refers to the group involved as Famous Chollima. The stated aim of the operation is to dismantle the local infrastructure that makes these fraudulent jobs possible.

Methods that adapt

The US authorities describe an evolution in practices. In response to tighter controls, the operators are said to be recruiting facilitators for a wider range of tasks and sometimes subcontracting entire positions to other foreign nationals. The press release publishes eleven email addresses associated with the identified schemes and refers to a new FBI alert.

According to the same press release, the risk is not limited to paying a salary to someone who is not who they claim to be. A fake employee has access to their employer's systems, which exposes the company to the theft of sensitive data and to extortion.

North Korea and remote hiring: what warning signs for Swiss companies?

The source does not mention any Swiss company among the employers affected: the case concerns American companies. But the modus operandi described is in no way specific to the United States, and any company that hires remote developers can draw a few good practices from it. What follows is an analysis based on the reported facts, not recommendations from the authorities:

  • Do not rely on the IP address alone: the presence of a machine in a country does not prove that its user lives there, nor that they are the person who was hired. VPNs and proxies are part of the scheme described.
  • Verify identity beyond the documents submitted: the documents used were stolen or fabricated. A video interview, direct reference checks and a consistent cross-check of identity, bank details and address reduce this risk.
  • Monitor equipment delivery: a delivery address that does not match the declared home address, or a change of address just before the laptop is shipped, warrants a question.
  • Spot unusual remote access: remote control tools or KVM switches connected to a company workstation are signals worth examining.
  • Check salary flows: a bank account in a third party's name or unusual payment requests should raise a red flag.
  • Limit access from the outset: giving a new remote employee only the rights they need reduces exposure in the event of fraud.

These measures fall under corporate cybersecurity as much as human resources: the fraud described begins with a hire, before becoming access to systems.

A revenue stream separate from hacks

This case illustrates a funding channel different from hacks of crypto platforms. No cryptocurrency flow is detailed for the revenue concerned here. The documented mechanism relies on recruitment, access to employers' systems and the intermediaries who make the fraud possible.

Sources

  • Journal du Coin: « Faux salariés, vrais revenus pour Pyongyang : Le FBI démantèle des réseaux aux US »