Full Report
Operation Lonestar Roundup uncovered an operation that used stolen identities to secretly funnel $3 million from 70 U.S. employers back to Pyongyang. The post DOJ charges 14 over a sprawling North Korean remote work scheme appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Famous Chollina (North Korean IT Workers)
## Attribution & Identity
* **Actor Identification:** North Korean Remote IT Workers.
* **State Affiliation:** Democratic People’s Republic of Korea (DPRK); specifically linked to the **Munitions Industry Department’s 313 General Bureau**.
* **Aliases:** Famous Chollina (CrowdStrike designation).
* **Associated Groups:** Often associated with broader North Korean state-sponsored financial and espionage operations aimed at circumventing international sanctions.
## Activity Summary
**Operation Lonestar Roundup:** A large-scale law enforcement action (October 2026) that disrupted a "laptop farm" scheme. The operation involved the seizure of approximately 187 computers and searches of over 40 residences. Between 2019 and 2025, the group used stolen identities to secure remote employment at over 70 U.S. companies, successfully funneling $3 million back to the North Korean government to fund weapons programs.
## Tactics, Techniques & Procedures
* **Laptop Farms:** Facilitators in the U.S. host employer-issued laptops to provide North Korean engineers with a domestic IP address and physical presence.
* **Identity Theft:** Using stolen or fabricated Social Security numbers, driver’s licenses, and names to pass background checks.
* **Remote Access Software:** Installation of tools to allow overseas workers to control U.S.-based hardware.
* **Interview Proxying:** Paying U.S. citizens to appear in video interviews and take drug tests on behalf of the North Korean worker.
* **Hardware Spoofing:** Using video capture cards to spoof webcams and manipulating device identifiers to bypass security checks.
* **Financial Fraud:** Moving funds through accounts opened under false names and filing fraudulent tax/employment records (IRS, SSA, DHS).
* **Extortion:** Threatening former managers or demanding payments backed by stolen data if fired or discovered.
* **Subcontracting:** Hiring unsuspecting freelancers in Pakistan, India, and Nigeria to perform the technical work to further mask the origin.
## Targeting
* **Sectors:** Technology (specifically AI firms), General Corporate/Business, and any sector offering remote IT positions.
* **Geography:** Primarily targeting employers in the **United States**.
* **Victims:** Over 70 U.S.-based companies; over 25 individual identity theft victims.
## Tools & Infrastructure
* **Hardware:** 187 seized computers, video capture cards (used for webcam spoofing).
* **Software:** Remote-access software (specific brands not named but used for C2 of laptop farms).
* **Infrastructure:** Residences in Texas and Pennsylvania used as "covert access points."
## Implications
This scheme represents a critical national security threat as it allows a hostile foreign regime to infiltrate American corporate networks and bypass economic sanctions. Beyond the $3 million in direct revenue, the access provides a platform for data theft and potential future espionage. The persistence of the group despite repeated indictments suggests a highly resilient and evolved operational model.
## Mitigations
* **Layered Identity Verification:** Implement multi-factor authentication and rigorous background checks that include in-person or high-assurance identity verification.
* **Hardware Integrity Checks:** Monitor for anomalous device identifiers or the use of video capture cards instead of integrated webcams.
* **Geographic Monitoring:** Use network monitoring to detect remote access tools and verify that the physical location of the laptop matches the employee's reported residence.
* **Enhanced Interviewing:** Conduct technical interviews that require real-time problem solving and visual verification, checking for "proxies" answering on behalf of the candidate.
* **Financial Scrutiny:** Review payroll accounts for names or banking patterns that deviate from initial onboarding documentation.