The US Department of Justice said on 13 October 2026 that it had charged 14 people and seized about 187 computers used in North Korean remote IT worker schemes. Two US nationals were arrested. The activity touched more than 70 US companies.
What happened
Between 21 and 25 September, the FBI searched more than 40 Texas residences in an operation it calls Lonestar Roundup. Agents took laptops and keyboard-video-mouse hardware that let workers outside the United States appear to be sitting at a US desk.
CrowdStrike tracks this cluster as Famous Chollima. Facilitators in the US received employer-issued laptops, kept them online, and moved wages toward North Korean-controlled accounts. Some operatives filed false theft reports so a replacement laptop would ship to a different address. Others used staffing firms so the end client never saw the real destination.
Who is affected
US employers who hired remote IT staff through facilitators are the direct victims. CrowdStrike said disrupted farms had ties to aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, and government technology work.
- Companies that shipped a laptop to a residential address they never visited.
- Staffing firms whose contractors redirected hardware after the offer.
- Teams that accepted a sudden relocation or a stolen-laptop replacement without a new identity check.
What to do now
Re-check remote IT hires from the last year: identity, laptop ship-to, and whether the machine still phones home from the address you shipped to. A KVM or a farm address is the tell. If a worker refused video onboarding, rotated addresses, or asked for a replacement after a theft report, treat the laptop as untrusted and rotate any credentials it held.
Payment redirection matters as much as the login. Confirm salary accounts match the person you think you hired, and do not treat a US facilitator as the employee.
Source: US Department of Justice, coordinated actions against North Korean remote IT workers.
Also on the blog
- CVE-2026-76519: Cisco Secure Email Gateway root via one attachment
- CVE-2026-0322: PAN-OS management root RCE, CVSS 8.6
- YAM Store takedown: kits behind 1 billion scam messages
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.