bleeping-computer · Crawled Oct 14, 2026
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
1 Actors
Read original article ↗
AI Summary
The U.S. Department of Justice disrupted operations of the North Korean threat group Famous Chollima (also known as WageMole), arresting two U.S. nationals and charging 14 individuals in connection with a scheme involving remote IT worker fraud. The group used stolen or fabricated identities to obtain technology jobs at U.S. companies, remotely accessed company-issued laptops hosted in 'laptop farms' in Texas, and laundered approximately $3 million to North Korea. The FBI operation, codenamed 'Lonestar Roundup,' seized 187 laptops and KVM devices used in the scheme, which ran from 2019 to July 2025 and impacted around 70 organizations.
AI-extracted · verify before operational use
Extracted Entities 1 found
MITRE ATT&CK TTPs 25 techniques
T1005 Data from Local System · Collection T1021.003 Distributed Component Object Model · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1056.001 Keylogging · Collection T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1113 Screen Capture · Collection T1114 Email Collection · Collection T1123 Audio Capture · Collection T1133 External Remote Services · Persistence T1204.002 Malicious File · Execution T1482 Domain Trust Discovery · Discovery T1490 Inhibit System Recovery · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1573 Encrypted Channel · Command And Control