US authorities have announced charges against 14 people, two arrests and the seizure of about 187 computer devices in coordinated actions targeting North Korean remote IT-worker schemes. The Justice Department announcement on 13 October covers an Ohio prosecution and a separate operation against suspected laptop farms in Texas.
A new FBI advisory concerns India’s freelance technology workforce. It says North Korean operators increasingly obtain jobs with Western companies, then subcontract assignments to freelancers in India, Pakistan, Nigeria and neighbouring countries for a fraction of the salary. The bureau says the North Korean involvement can be difficult for victims to recognise.
The Texas searches and other enforcement action took place from 21 to 25 September at more than 40 residences. Devices seized included laptops and equipment used to control computers remotely. In the Ohio case, prosecutors say a scheme affected more than 70 US employers across sectors including healthcare, communications, retail and manufacturing. The Ohio prosecution includes wire-fraud, money-laundering and identity-theft allegations, according to the announcement.
What the Ohio indictment alleges
The federal indictment describes a structure built around US-based helpers who hosted employer-issued laptops. Prosecutors allege that they installed software or connected hardware that let overseas workers use those machines without the companies’ permission. Shell companies, websites and financial accounts allegedly helped make the workers appear connected to legitimate US businesses, while payments from employers passed through accounts before being transferred overseas.
The alleged damage extended beyond wages paid for the work. The filing says the identities of more than 25 US persons were compromised, about $3 million in revenue was generated for the overseas workers, and victim companies incurred at least $3 million in legal fees, network repair costs and other losses. These are amounts alleged in the indictment, rather than a court’s assessment after trial.
The document also describes allegedly falsified college diplomas, employment references and identification papers used in job applications. Earnings were reported to US tax and social-security authorities under stolen identities, prosecutors say. The alleged result was that people whose identities had been misused appeared in official records for work performed by someone else.
The criminal charges are allegations. The defendants are presumed innocent unless proved guilty in court. The Justice Department says the broader operation forms part of its continuing effort to disrupt illicit revenue generation and the US-based helpers enabling it.
Why hiring checks need more than a blacklist
In its first-party account of the investigation, published on 13 October, CrowdStrike describes attempts to divert company equipment to laptop farms during onboarding. Its investigators observed false reports of stolen laptops used to obtain replacements and claims of last-minute relocations that redirected shipments. It also found cases involving IT staffing firms whose clients’ devices were diverted without the staffing firms knowing.
The company reports that operators had started disguising device identifiers from May 2026, including making video-capture equipment appear to be a webcam. More recently, investigators saw the same disguised device across different victim organisations. Its account also describes shared network identifiers across several false worker identities, showing how apparently separate hires could connect to the same supporting infrastructure.
CrowdStrike says the disrupted clusters affected organisations in aerospace, energy, financial services and other industries. It cautions that the takedowns are likely to slow operations mainly where the farms were closed, rather than end the wider activity. Its assessment is that the operators will continue changing methods to avoid detection.
The FBI cautions employers against treating one warning sign as proof. It recommends combining checks throughout employment, with information technology, human resources, security and management teams sharing relevant observations. Filtering applicants only by names or lists of previously identified identities can exclude qualified people or harm identity-theft victims. The advisory calls for careful review because behaviour associated with the schemes can overlap with legitimate remote work.
For individuals, the bureau warns against paid requests to lend personal information or account access, attend interviews for someone else, or host unfamiliar work laptops. Such requests deserve scrutiny even when presented as freelance gigs.
For more on identity-related risks, see Dalimss News coverage of impersonation scams and Android’s optional security logs.
