Key points
- The FBI seized 187 laptops and KVM switches from Texas residences linked to North Korean IT workers.
- The scheme targeted 70 US companies across 17 states, generating $3 million in revenue for the regime.
- Two US nationals were arrested and 14 people charged in connection with Operation Lonestar Roundup.
North Korean intelligence agents infiltrated American companies by posing as remote IT workers using stolen US identities. The Justice Department announced coordinated enforcement actions this week to disrupt this long-running scheme. According to Security Affairs, the operation targeted 70 US companies and generated $3 million in revenue. The funds were sent to sanctioned entities controlled by the Democratic People’s Republic of North Korea.
By the numbers
- 40 residences in Texas were raided by the FBI during the enforcement operation.
- 187 computer devices, including laptops and KVM switches, were seized from the sites.
- 70 US companies across 17 states were targeted by the fraudulent employment scheme.
What the figures mean
The scale of the device seizures indicates a centralized infrastructure rather than individual freelance operations. The Justice Department stated that the seized laptops were those American companies shipped to their newly hired remote employees. These devices were not used by the individuals who received them. Instead, American helpers installed remote access software so North Korean workers could control the machines from abroad.
The indictment from the Northern District of Ohio reveals the scheme ran from 2019 to mid-2025. The victims operated in sectors including healthcare, communications, cybersecurity support, retail, and manufacturing. The diversity of sectors suggests the threat actors did not target a specific industry vertical but rather sought any remote IT position. The use of VPNs and proxy servers allowed the workers to mask their true geographic location, making them appear as if they were operating from within the United States.
What to watch
Security teams should monitor for anomalies in remote employee behavior, such as login times that do not match the employee’s stated time zone. The use of KVM switches in residential settings is unusual for standard remote work and may indicate a multi-device operation. Organizations should verify the physical location of remote workers through consistent video checks and network telemetry. Any discrepancy between the IP address location and the employee’s verified address warrants immediate investigation.
Infection and persistence in general
Remote work fraud campaigns typically arrive through legitimate hiring channels, bypassing traditional perimeter defenses. Persistence is maintained not through malware, but through valid employee credentials and access rights. Analysts should examine user behavior analytics for deviations in login patterns, data access, and communication styles. Check whether remote access tools show connections from unexpected geographic regions or devices. Verify that the person on the video call matches the identity documents provided during onboarding. Look for signs of screen sharing or remote control software being used excessively.
What to do and how to stay safe: North Korea
- Review remote employee onboarding procedures to ensure identity verification includes live video interaction.
- Monitor network logs for remote access sessions originating from IP addresses inconsistent with the employee’s location.
- Audit privileged access rights for remote IT staff to ensure they follow the principle of least privilege.
- Verify that hardware provided to remote workers is not being shared or accessed by unauthorized third parties.
Step-by-step guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the North Korean workers hide their true location from US companies?
They used VPNs and proxy servers to make it appear as though they were working from within the United States.
What devices did the FBI seize during the Texas raids?
The FBI seized approximately 187 laptops and KVM switch devices from more than 40 residences in Texas.
How much revenue did the scheme generate for North Korean entities?
The scheme generated approximately $3 million in revenue, which was sent to sanctioned entities controlled by the DPRK.
