Abstract:
The U.S. Department of Justice announced that U.S. law enforcement agencies have recently launched a coordinated operation against North Korean remote IT personnel for fraudulently entering the networks of U.S. companies, involving arrests, prosecutions, and searches of "laptop farms." Prosecutors said relevant individuals used stolen or forged U.S. identities to apply for remote positions, affecting at least 70 U.S. companies and bringing about $3 million in income to related IT personnel; this money is believed to have flowed to North Korean sanctioned entities.
The investigation revealed that the individuals involved used stolen identity information, virtual private networks, and proxy infrastructure to trick their employers into thinking they were American employees in the United States. The local facilitator in the United States received the work computer sent by the victim company at his residence, set up the equipment, installed remote access software, and transferred the salary to an account controlled by North Korea. Known as "laptop farms," these residences allow people overseas to remotely operate their employer's equipment while masking their true location.
The Department of Justice stated that the FBI conducted searches and other law enforcement operations at more than 40 known or suspected laptop farm residences in Texas from September 21 to 25. During the operation, approximately 187 laptop computers and keyboard, video, and mouse control equipment were seized. Investigators believe the devices were used to impersonate remote employees, obtain corporate positions and generate revenue for the North Korean regime. Cybersecurity firm CrowdStrike assisted the FBI in the investigation and dubbed the operation network "Famous Chollima."
The indictment announced by the U.S. Attorney's Office for the Northern District of Ohio involves 14 people, two of whom have been arrested. They are Michael James Bostelle from Pennsylvania and Juan Cecilio Pena Carrillo from Texas. The two men and their associates are accused of participating in a multi-year wire fraud, money laundering and identity theft scheme. The indictment also names multiple defendants in China, and the identities of two other defendants remain sealed. The charges are pending in court and the defendants are presumed innocent until proven guilty.
The Department of Justice said that the relevant companies are located in Ohio and 16 other states and the District of Columbia, and the industries include health care, communications, network security support, retail and manufacturing. The FBI also warned that North Korean IT personnel are expanding their use of U.S. intermediaries, including asking people to participate in video interviews on their behalf, verify false identities, provide social media or professional networking accounts, receive and host work equipment, and even subcontract the entire work to other foreign freelancers. The FBI said such individuals number in the thousands and pose a national security and intellectual property risk; the scale is part of the agency's threat assessment.
The FBI reminds that companies should not rely on a single signal or a simple blacklist to identify those involved, but should implement multi-layer verification in recruitment, identity verification, equipment configuration and on-the-job management, and make collaborative judgments between human resources, information technology and security teams. The agency also warned that some Americans may be recruited to assist without their knowledge or being lured with money. If they receive or host work computers for others or provide identity and account information, they may face law enforcement risks.
Comments