US arrests two and seizes 187 laptops in crackdown on North Korean IT worker laptop farms

TLDR

• US authorities arrested two US nationals accused of hosting laptops that let North Korean IT workers pose as US-based employees.¹²
• Laptop farms give North Korea US addresses and legal cover it cannot get abroad, making them a choke point.¹²
• CrowdStrike expects limited impact from the raids but calls them the start of a broader US effort.¹²

The indictment charges Bostelle and Pena with wire fraud, money laundering and identity theft.¹ Prosecutors say the workers used stolen or fabricated identities plus VPN and proxy infrastructure to appear US-based, while the facilitators hosted company-issued laptops, installed remote-access software and moved earnings to accounts controlled by North Korea.¹² BleepingComputer reports 14 people charged and separate charges against 12 Chinese defendants, while SecurityWeek lists ten China-based co-defendants in the four-count indictment.¹²

CrowdStrike says the operatives persuaded employers to ship laptops to farm addresses by filing fake theft reports to trigger replacements, rotating through residential addresses, claiming last-minute relocations, and abusing IT staffing roles to redirect shipments.¹² As organisations tightened defences, the group began hiding its remote-access tools, spoofing device hashes and reusing device identifiers across victims and personas.¹² CrowdStrike says the victim organisations identified span aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology.²

Why it matters: laptop farms give a foreign revenue scheme the US address, legal identity and regulatory cover it cannot obtain from abroad, so the farms are a real choke point, even though CrowdStrike expects the disruption to have limited impact, and its warning that the activity targets any employer offering remote work means hiring and device-shipment controls remain the main defence.