(San Francisco/Seoul = Yonhap News) Correspondent Kwon Young-jeon and Reporter Lee Ji-heon = A 'laptop farm', a remote base for North Korean information technology (IT) workers disguised as employed by American companies, has been uncovered again.
Through a separate investigation, U.S. judicial authorities arrested two facilitators in the U.S. who participated in undercover employment of North Korean IT workers and brought to trial about 10 people, including a supervisor living in China.
The U.S. Federal Bureau of Investigation (FBI) and the U.S. Attorney's Office for the Northern District of Texas announced on the 13th (local time) that they had dismantled the illegal network of North Korean IT workers through the joint operation 'Lone Star Roundup' conducted across the state.
Through this operation, they searched about 40 residential areas and confiscated 187 laptops and KVM (keyboard, video, mouse) devices that were abused by North Korean workers to infiltrate American companies.
“Operation Lone Star Roundup was conducted to deter malicious cyber activities conducted by the North Korean government to support its weapons of mass destruction (WMD), ballistic missiles, intelligence programs, and nuclear programs,” said FBI Dallas Division Director R. Joseph Rothrock, adding, “One of the seized laptops represents a company that employed North Korean IT personnel.”
It was revealed that North Korean workers used stolen or forged U.S. ID cards and virtual private networks (VPNs) that could manipulate Internet access locations to get jobs by disguising themselves as if they were working remotely from within the United States.
Helpers in the United States who helped North Korea received and installed remote work laptops sent by victim companies at their homes and installed remote access software to provide laptop farms where North Korean hackers and workers could freely access them.
They were also responsible for receiving salaries and transferring them to accounts controlled by the North Korean authorities.
CrowdStrike, an American cyber security company, named the group of North Korean IT agents and the forces assisting them who commit such crimes as 'Famous Chollima'.
Federal Prosecutor Ryan Raybould said, “This investigation goes far beyond a simple case of fraud,” and pointed out, “We will not sit idly by while America’s enemies take advantage of our companies or threaten national security.”
In particular, Prosecutor Raybold said, "It is absurd to have dozens of laptops in the living room and then claim to the government that they 'didn't know what they were doing'," and also predicted legal action against those in the United States who helped North Korea.
Investigative authorities released 11 email accounts used in the crime and requested information.
Meanwhile, the U.S. Department of Justice announced on this day that it had indicted the alleged facilitators and conspirators residing in China who were discovered through a separate investigation in connection with the undercover employment of North Korean IT workers and made public the indictment.
According to an announcement from the Ministry of Justice, the federal prosecutor's office in the Northern District of Ohio arrested Michael James Bostel, who lives in Pennsylvania, and Juan Cecilio Peña Carrillo, who lives in Texas, on four charges, including telecommunications fraud and money laundering, and brought them to trial.
U.S. prosecutors indicted 10 people living in China, including the leader Son Seong-myeong (Chinese pronunciation: Sun Seong-ming), who lives in Dandong, China, and two unnamed people as co-conspirators.
They found that from 2019 to July 2025, North Korean IT workers participated in false employment in remote jobs by disguising themselves as Americans with false identity documents.
Bossel and Peña Carrillo, both American nationals, were found to have operated a laptop farm and acted as facilitators in the U.S. to facilitate fake employment.
Of the 10 Chinese residents whose names were written in Chinese pronunciation in the indictment, some were stated to be Chinese nationals, but for some, their nationalities were not specified. It was found that they received money or packages sent from their helpers in the United States in China.
Their fake employment activities caused damage to about 70 American companies, and the fake workers earned about $3 million in profits. The Ministry of Justice explained that the proceeds of crime are believed to have flowed to sanctioned organizations controlled by North Korea.
The Justice Department said the FBI's Cleveland branch is continuing its investigation into this case.
“The Department of Justice’s National Security Agency, along with relevant law enforcement agencies, will pursue all those assisting North Korea and use all available tools to protect national security,” said John Eisenberg, the U.S. Justice Department’s assistant attorney general for national security.
This is not the first time that a laptop farm like this, which is being abused as a means of earning foreign currency for North Korea, has been discovered.
The U.S. Department of Justice announced in June of last year that it had uncovered 29 laptop farms in 16 states in the U.S., and a woman from Arizona was sentenced to 8 years and 6 months in prison after being found guilty of helping North Korea with a laptop farm discovered in 2023.
Texas local broadcaster 'Fox 4' reported, citing estimates from the Ministry of Finance, that the profits North Korean IT workers earned through this method amounted to approximately $800 million (approximately KRW 1.08 trillion) in 2024 alone.
