indictment_4067.pdf (5 MB)

U.S. authorities charged 14 people, arrested two alleged U.S.-based facilitators, and seized approximately 187 devices while disrupting more than 40 suspected Texas laptop farms supporting North Korean remote IT workers. The workers allegedly used stolen or fabricated identities, VPN and proxy infrastructure, remote-access software, and domestic facilitators to obtain jobs at more than 70 U.S. companies and generate over $3 million. Authorities believe the proceeds were transferred to sanctioned DPRK entities connected to the country's weapons programs. CrowdStrike tracks the DPRK workers and their helpers as Famous Chollima, and investigators published 11 fraudulent email accounts as detection indicators.