In short
- Agents seized 187 laptops and KVM devices from over 40 Texas residences used as laptop farms for DPRK IT workers.
- Investigators identified fraudulent Google accounts and U.S.-based facilitators supporting remote employment schemes for North Korea.
What happened
Federal agents executed searches at more than 40 residences in Texas, seizing 187 laptops and KVM devices operated as laptop farms for Democratic People's Republic of Korea IT workers. Approximately 100 devices were seized in North Texas, used by DPRK workers and U.S.-based facilitators to obtain remote employment and generate revenue for North Korea’s sanctioned weapons programs.
Investigators found DPRK IT workers used stolen or fabricated identity documents, VPNs, and proxy infrastructure to appear as U.S.-based employees. U.S. facilitators received laptops from victim companies, configured them, installed remote-access software, and transferred earnings to DPRK-controlled accounts. Several fraudulent Google accounts were identified as part of the scheme.
Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.
In numbers
- 187 laptops and KVM devices seized
- over 40 residences searched in Texas
- 100 devices seized in North Texas
What compliance teams should check
- Screen for remote hires using the fraudulent Google accounts listed: Bright.star.me208@gmail.com, Merrttank.bz@gmail.com, randyryang@gmail.com, michaelb860102@gmail.com, assassinki211@gmail.com, dev.jerryyang@gmail.com, denis.turgenev2021@gmail.com, yesiree.cano825@gmail.com, thomasdenzelbrown@gmail.com, anthonyortega4592@gmail.com, tyler.j.palmi38@gmail.com.
- Review employee onboarding for signs of stolen or fabricated identity documents, VPN or proxy use, and links to U.S.-based facilitators as described in the DOJ investigation.
- Monitor for activity associated with the 'Famous Chollima' threat network, as identified by CrowdStrike and referenced in the DOJ release.
Why it matters
This case highlights the risk of hostile foreign actors infiltrating U.S. companies through remote employment schemes, using stolen identities and covert access points. The operation demonstrates how such networks can generate revenue for sanctioned regimes and threaten national security. Compliance officers must be vigilant for fraudulent identity documents, suspicious remote access, and links to known threat networks, as these tactics directly undermine AML/CFT controls and expose companies to regulatory and reputational risks.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.