Full Report
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money
Analysis Summary
# Threat Actor: Famous Chollima
## Attribution & Identity
* **Actor Identification:** North Korean (DPRK) Remote IT Workers (ITW).
* **Aliases:** Famous Chollima, PurpleDelta (Purplebravo), Wagemole.
* **Associated Entities:** The U.S. Department of Justice has identified a network involving North Korean operatives, Chinese nationals (e.g., Sun Sheng Ming, Pei Li Guang), and U.S.-based facilitators (e.g., Michael James Bostelle, Juan Cecilio Pena Carrillo).
* **Shell Companies:** Dark Falls LLC (managed by Trey Michael Nolte).
## Activity Summary
The actor operates a multi-year fraudulent scheme (active from approximately 2019 to July 2025) designed to infiltrate Western companies by posing as legitimate remote IT professionals. The primary goal is to generate illicit revenue for the North Korean government to fund its nuclear and military programs. In October 2026, the U.S. DOJ announced the disruption of this scheme, involving the seizure of 187 computers and the dismantling of over 40 "laptop farms" in Texas.
## Tactics, Techniques & Procedures
* **Identity Theft:** Using stolen or fraudulent identities to apply for remote IT positions.
* **Laptop Farms:** Utilizing U.S.-based facilitators to host company-issued laptops at residential addresses to mask the workers' true location.
* **Remote Access Fraud:** Leveraging remote-access technology to connect from overseas (North Korea/China) to the U.S.-based laptops, making it appear that the worker is domestic.
* **Financial Laundering:** Setting up U.S. bank accounts and online money transfer services to funnel salaries back to the DPRK regime.
* **Social Engineering:** Posing as software developers during interviews and onboarding processes.
* **MITRE ATT&CK IDs:**
* T1136 (Create Account)
* T1078 (Valid Accounts)
* T1213 (Data from Information Repositories)
* T1566 (Phishing - specifically "Contagious Interview" campaigns mentioned in related context)
## Targeting
* **Sectors:** Health care, communications, cyber support, retail, and manufacturing.
* **Geography:** Primarily the United States (affecting entities in Ohio, Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania, Washington, and D.C.).
* **Victims:** Over 70 U.S.-based companies.
## Tools & Infrastructure
* **Malware:** While not explicitly named in this specific indictment, related campaigns involve remote access tools (RATs) to facilitate connection to laptop farms.
* **Infrastructure:**
* **Laptop Farms:** Residential locations in Texas used to host hardware.
* **Remote Access Software:** Used to tunnel connections from DPRK/China to U.S. systems.
* **Financial Infrastructure:** PayPal, Payoneer, and various U.S. bank accounts for money laundering.
## Implications
This scheme represents a significant national security threat by providing a steady stream of hard currency (approx. $3 million in this specific case) to a sanctioned regime. Beyond financial theft, the presence of state-sponsored actors within a company's internal network poses a high risk of intellectual property theft, data breaches, and potential supply chain compromise.
## Mitigations
* **Enhanced Identity Verification:** Implement mandatory video interviews with identity document verification and background checks that scrutinize inconsistencies in employment history.
* **Hardware Geo-fencing:** Monitor and restrict remote access to company-issued hardware based on geographic location and anomalous IP ranges.
* **Endpoint Monitoring:** Deploy EDR (Endpoint Detection and Response) to identify unauthorized remote access software or unusual administrative activity on laptops.
* **Shipping Scrutiny:** Verify that the shipping addresses for company hardware match the verified residential address of the employee, and be wary of residential addresses that appear to host multiple corporate devices.