conv.

All stories
SecurityActive · 35h

FBI and CrowdStrike Dismantle 40+ North Korean Laptop Farms in Texas

Federal investigators and the cybersecurity firm seized nearly 200 devices and indicted 12 people in a push to cut off a major revenue stream funding Pyongyang's weapons programs.

newest coverage 2h agosummary written 1d ago53 pieces36 likes & upvotes2 comments NewswiresMastodonXHacker NewsGoogle NewsYouTubeReddit

What to know

  • The FBI and CrowdStrike dismantled over 40 laptop farms across Texas used by North Korea to hire remote IT workers under stolen American identities, seizing nearly 200 devices.
  • Justice Department indicted 2 U.S. nationals and 10 China-based North Koreans for defrauding 70 companies of $3+ million between 2019 and 2025 through identity theft.
  • U.S. officials identify the IT worker scheme as a primary funding source for North Korea's nuclear and ballistic weapons programs, alongside cryptocurrency theft.
  • CrowdStrike reports identifying an average of two new North Korean laptop farm cases per day in September, indicating the operation remains widespread and difficult to fully quantify.

“The North Korean IT worker scheme is among the most serious ongoing digital threats facing businesses today and that it remains underappreciated as a risk.”

U.S. officials and cybersecurity analysts, Government and security experts · Boston Globe ↗

FBI Lead federal investigatorCrowdStrike Cybersecurity firm partnerBrett LeathermanBrett Leatherman Head of FBI cyber divisionAdam Meyers Counteradversary operations lead at CrowdStrikeU.S. Justice Department Prosecuting authority

FBI and CrowdStrike Dismantle 40+ North Korean Laptop Farms in Texas
The Record

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 20 pieces in one half hour at Oct 13, 4 PM; 53 pieces over 36 hours (38 articles · 2 videos · 13 posts) Oct 13, 2:12 PM — quietOct 13, 2:42 PM — 6 pieces · 5 articles · 1 post — Newswires 4, Mastodon 2Oct 13, 3:12 PM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Oct 13, 3:42 PM — quietOct 13, 4:12 PM — 8 pieces · 8 articles — Google News 6, Newswires 2Oct 13, 4:42 PM — 20 pieces · 17 articles · 3 posts — Newswires 17, X 2, Mastodon 1Oct 13, 5:12 PM — quietOct 13, 5:42 PM — quietOct 13, 6:12 PM — quietOct 13, 6:42 PM — quietOct 13, 7:12 PM — quietOct 13, 7:42 PM — quietOct 13, 8:12 PM — quietOct 13, 8:42 PM — 1 piece · 1 post — Hacker News 1Oct 13, 9:12 PM — 3 pieces · 3 articles — Google News 3Oct 13, 9:42 PM — quietOct 13, 10:12 PM — 1 piece · 1 post — Mastodon 1Oct 13, 10:42 PM — quietOct 13, 11:12 PM — quietOct 13, 11:42 PM — quietYesterday, 12:12 AM — quietYesterday, 12:42 AM — quietYesterday, 1:12 AM — quietYesterday, 1:42 AM — quietYesterday, 2:12 AM — quietYesterday, 2:42 AM — quietYesterday, 3:12 AM — quietYesterday, 3:42 AM — quietYesterday, 4:12 AM — quietYesterday, 4:42 AM — quietYesterday, 5:12 AM — quietYesterday, 5:42 AM — quietYesterday, 6:12 AM — quietYesterday, 6:42 AM — 1 piece · 1 article — Newswires 1Yesterday, 7:12 AM — quietYesterday, 7:42 AM — quietYesterday, 8:12 AM — quietYesterday, 8:42 AM — quietYesterday, 9:12 AM — quietYesterday, 9:42 AM — quietYesterday, 10:12 AM — 1 piece · 1 article — Newswires 1Yesterday, 10:42 AM — 1 piece · 1 post — Reddit 1Yesterday, 11:12 AM — quietYesterday, 11:42 AM — quietYesterday, 12:12 PM — quietYesterday, 12:42 PM — quietYesterday, 1:12 PM — quietYesterday, 1:42 PM — 1 piece · 1 video — YouTube 1Yesterday, 2:12 PM — 1 piece · 1 post — Mastodon 1Yesterday, 2:42 PM — quietYesterday, 3:12 PM — 1 piece · 1 post — Mastodon 1Yesterday, 3:42 PM — quietYesterday, 4:12 PM — quietYesterday, 4:42 PM — quietYesterday, 5:12 PM — quietYesterday, 5:42 PM — quietYesterday, 6:12 PM — 2 pieces · 1 article · 1 video — Newswires 1, YouTube 1Yesterday, 6:42 PM — quietYesterday, 7:12 PM — quietYesterday, 7:42 PM — quietYesterday, 8:12 PM — quietYesterday, 8:42 PM — quietYesterday, 9:12 PM — 1 piece · 1 post — Mastodon 1Yesterday, 9:42 PM — quietYesterday, 10:12 PM — 1 piece · 1 post — Hacker News 1Yesterday, 10:42 PM — quietYesterday, 11:12 PM — 1 piece · 1 post — Mastodon 1Yesterday, 11:42 PM — quietToday, 12:12 AM — quietToday, 12:42 AM — quietToday, 1:12 AM — quietToday, 1:42 AM — 1 piece · 1 article — Mastodon 1 12
4 PMyesterday8 AM4 PMnow · 2:12 AM ET
  1. 2

    CrowdStrike confirms partnership in disruption effort

    CrowdStrike publicly confirmed its partnership with the FBI in identifying and disrupting the laptop farms, noting the operations targeted what the cybersecurity firm calls FAMOUS CHOLLIMA, North Korea's IT worker operation.

    “CrowdStrike is proud to have partnered with the FBI in identifying and disrupting U.S.-based laptop farms used by FAMOUS CHOLLIMA to infiltrate organizations, conceal operatives' identities, and generate revenue for the...”
    — @crowdstrike
    1. 17 outlets Alleged North Korean ‘laptop farm’ network busted by Justice Department

      first by NewsNation, 1d ago · also WFAA, Tom's Hardware, Defense One, Cyber Security News, iTnews, The Record +10

      12 more headlines
    2. 6 outlets FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

      first by BleepingComputer, 1d ago · also Gizmodo, Dallas Express, Metacurity, Help Net Security, FOX 4 News Dallas-Fort Worth

      5 more headlines
    • BleepingComputer@infosec.exchange

      The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. https://www. bleepingcomputer.com/news/secu rity/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/

      BleepingComputer@infosec.exchangeMastodon10h agoview on Mastodon ↗
    2 more of the top 3 · 4 posts in this stretch

    • A major step forward in disrupting North Korea's illicit IT worker operations. CrowdStrike is proud to have partnered with the FBI in identifying and disrupting U.S.-based laptop farms used by FAMOUS CHOLLIMA to infiltrate organizations, conceal operatives' identities, and generate revenue for the...

      @crowdstrikeX1d agoview on X ↗
    • houstonpublicmedia@mastodon.social

      The homes of over 40 residents in Texas were raided as part of an FBI investigation into an alleged North Korean “laptop farm.” https://www. houstonpublicmedia.org/article s/news/2026/10/14/564376/fbi-raids-north-texas-homes-for-alleged-role-in-north-korean-laptop-farm-operation/

      houstonpublicmedia@mastodon.socialMastodon11h agoview on Mastodon ↗
    all of them →
  2. 1

    FBI and CrowdStrike announce disruption publicly

    Federal authorities and CrowdStrike publicly announced the operation targeting what officials describe as a primary method of funding North Korea's weapons program alongside cryptocurrency theft. Brett Leatherman, head of the FBI's cyber division, stated the coordination exemplifies the bureau's new cyber strategy emphasizing private-sector collaboration.

    “Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer.”
    — Brett Leatherman
    1. 2 outlets FBI disrupts Pyongyang revenue stream: North Koreans in US tech jobs

      first by Boston Globe, 1d ago · also NYT

      1 more headline
  3. background

    Justice Department unseals indictments against North Korean IT scheme participants — Prosecutors in Ohio unsealed indictments against two U.S. nationals and 10 China-based North Koreans accused of using stolen identities to earn paychecks from unwitting U.S. companies. The scheme bilked 70 companies out of more than $3 million and ran from 2019 to 2025, with identities of two additional defendants remaining sealed.

  4. background

    FBI disrupts North Korean laptop farm network in Texas — The FBI conducted an operation dismantling more than 40 so-called laptop farms across Texas and seizing nearly 200 computer devices used by North Korean operatives to obtain remote IT jobs under stolen American identities.

What people are saying 1 voices from 1 site · best of 4 · verbatim