North Korean IT workers covertly employed in the United States: mass ‘laptop farms’ uncovered··· “A sanctionsevasion funding stream for nuclear weapons development” - 경향신문
This article was translated by an AI tool. Feedback Here.
Citizens use computers at the Sci-Tech Complex in Pyongyang, North Korea. In North Korea, only a privileged class accounting for less than 1% of the total population can access the internet. AP Yonhap News
A so-called ‘laptop farm’, the remote hub used by North Korean information technology (IT) workers who covertly obtained jobs in the United States to evade international sanctions, has been uncovered.
The Ministry of Justice said on the 13th (local time) that the Federal Bureau of Investigation (FBI) and the U.S. Attorney for the Northern District of Texas disrupted an illegal network of North Korean IT workers under the joint operation conducted across the state of Texas, “Lone Star Roundup”.
According to the Ministry of Justice, the operation searched more than 40 residences and seized 187 devices, including laptops and KVM (keyboard, video, and mouse) equipment, which had been exploited to infiltrate U.S. companies without authorization.
Brett Leatherman, head of the FBI Cyber Division, said, “North Korea is deploying thousands of state-controlled IT workers to the United States and allied countries,” adding, “Each job they secure becomes a funding stream for its nuclear weapons and ballistic missile development programs.”
North Korean workers used stolen or forged U.S. identification and virtual private networks (VPNs) that can manipulate the apparent internet access location to pose as remote employees working from within the United States and obtain jobs. U.S.-based enablers who assisted North Korea received remote-work laptops sent by victim companies to their homes, set them up, installed remote-access software, and provided laptop farms that allowed North Korean hackers and workers to connect freely. They also transferred wages to accounts controlled by North Korea.
U.S. cybersecurity firm CrowdStrike dubbed the North Korean IT operatives who commit such crimes, and the forces that assist them, “Famous Chollima”. Adam Meyers, who handles the related work at CrowdStrike, told the New York Times that “the frequency of North Korean jobmasquerading tactics is increasing, and their complexity is also becoming more sophisticated”.
Ryan Raybould, a federal prosecutor with the U.S. Attorney for the Northern District of Texas, said, “This investigation goes far beyond a simple fraud case,” adding, “We will not stand by while adversaries of the United States exploit our companies or threaten national security.”
The Ministry of Justice said last June that it had uncovered 29 laptop farms in 16 U.S. states, and a woman from Arizona was sentenced by a court to eight years and six months in prison after being found guilty of aiding North Korea through a laptop farm uncovered in 2023.
Texas regional broadcaster ‘Fox 4’ reported, citing a Treasury Department estimate, that the revenue earned by North Korean IT workers through this method amounted to about $800 million in 2024 alone (about 1.08 trillion KRW).
