Our takeDOJ charged 14 people in Operation Lonestar Roundup for a North Korean scheme that used stolen identities and laptop farms to land remote IT jobs at 70 US employers and send $3M back to Pyongyang. If your hiring only screens technical roles, widen identity checks to every remote position.Security Resilience desk
Sources (2)
- cyberscoop · cyberscoop
- securityweek · securityweek
What this means for you — Security leader:Review remote-work identity and device policies. Require video interviews, geolocation checks on corporate devices, and multi-factor authentication on all endpoints to block stolen-identity remote workers.
What this means for you — Lean IT orgs:If you hire remote contractors, verify identities with video calls and check that devices stay in the expected country. Stolen US identities and laptop farms are now a proven North Korean funding method.
What this means for you — MSP:Add identity and location verification steps to every remote-worker onboarding checklist across clients. Monitor for laptop-farm indicators (multiple logins from single IPs, mismatched geodata) and flag suspicious contractors immediately.
What this means for you — Researcher:DOJ unsealed charges detailing a North Korean IT worker scheme that used stolen identities and laptop farms to extract $3 M from 70 US employers; 14 charged and 187 laptops seized in Texas raids.