DOJ charges 14 and shuts 40 laptop farms in North Korean IT worker identity scheme

The US Justice Department on Tuesday, October 13, charged 14 people, US citizens and Chinese nationals, in a conspiracy that placed North Korean IT workers in remote jobs under fake and stolen identities, according to The Hacker News. Charges include wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft. Raids between September 21 and 25 dismantled more than 40 laptop farms across Texas and seized about 187 computers and KVM devices. DOJ says the scheme affected more than 70 US employers and earned about $3 million. Facilitators hosted company-issued laptops at their homes and used remote-access tools so overseas workers appeared to be US-based, while hired freelancers sometimes applied or interviewed on the workers' behalf. The FBI says the workers also claim other people's social and professional profiles as their own.

Why it matters

This is an identity proofing failure at hiring, not a login failure. Every downstream control, SSO, MFA and device management, worked as designed for an employee who was never the person the company vetted. A laptop farm supplies the address and the device that make the hire look real.

Treat onboarding as identity verification with the same rigor as a high-value customer account: verify a government document against a live person at offer and again at first device pickup, and match payroll, shipping address and the person on camera. Flag requests to ship laptops to a new address, replacement-device requests backed by police reports, and remote-access tools on corporate endpoints. CrowdStrike reports the actors have spoofed device hashes since at least May 2026, for example presenting a capture card as a webcam, so check the video device on interview calls too. Apply the same checks to contractors placed through staffing firms, where the vetting is easiest to assume.

Source: The Hacker News