US authorities target North Korean laptop farms and remote IT worker scheme

The United States Department of Justice charged 14 individuals and seized 187 computers to disrupt a fraudulent North Korean IT worker scheme, according to reports from SecurityWeek and The Hacker News. CyberSecurityNews reported that the Federal Bureau of Investigation disrupted laptop farms associated with the North Korean group Famous Chollima. SecurityWeek and The Hacker News both reported that law enforcement seized about 187 laptops used in the operations. [2][3][4]

According to SecurityWeek, investigators searched 40 locations in Texas. Two United States citizens were arrested in the operation, identified by SecurityWeek as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. SecurityWeek reported that the suspects allegedly assisted North Korean remote workers to secure positions at American firms. The Hacker News reported that the overall indictment includes a mixture of United States citizens and Chinese nationals. [2][3]

The fraudulent scheme affected more than 70 companies in the United States, according to The Hacker News. SecurityWeek reported that the multi-year fraud operation involving Bostelle, Pena, and co-conspirators generated over $3 million. Charges in the case include wire fraud conspiracy and money laundering conspiracy, according to The Hacker News. [2][3]

Separate reports from SC Media and The Record from Recorded Future News noted that North Korean hackers are targeting Ukraine and Ukrainian experts to obtain intelligence regarding the war in Russia. United States authorities continue efforts to disrupt North Korean operations that bypass international sanctions through remote technical work and cyber activities. [1][3][7]