The U.S. Department of Justice has dismantled a network of residential "laptop farms" used to place North Korean IT workers inside Western companies, charging 14 individuals, arresting two suspects — reported to include U.S. nationals — and seizing about 187 laptops, according to BleepingComputer, which covered the raids on 14 October.
The operation targets the threat group known as Famous Chollima, a North Korean-linked cluster focused on illicit overseas employment rather than espionage or destructive intrusion. It is a distinct operation from the Lazarus (APT38) and APT37 (Reaper) groups that dominate headlines for bank heists and supply-chain attacks, and conflating the three obscures how this particular fraud works — and how to screen against it.
How a laptop farm works
The scheme is physical, not just digital. In its simplest form, a Western company hires a "remote developer" whose résumé, English fluency, and video interviews all pass muster. The worker is North Korean. The catch is that the company-issued laptop is never shipped to the worker's claimed address; it goes to a residential address in the United States, where a paid local facilitator unboxes it, plugs it into a domestic broadband connection, and exposes it remotely to Pyongyang. The result: a North Korean operator whose traffic carries a U.S. IP address, sits in a plausible time zone, and holds direct, logged-in access to corporate credentials, internal tooling, and source code. The DoJ complaint describes precisely this arrangement at residential locations in Texas, with roughly 187 laptops seized in the operation.
Reported losses across the global DPRK IT worker scheme have run into the billions of dollars, though estimates vary widely depending on methodology and on how much of the activity is ever detected.
Red flags for remote hiring
Because the scheme monetises labour rather than exploiting a software vulnerability, there is no patch. Defences are procedural, and the following signals are drawn from the DoJ complaint and from vendor and government reporting on DPRK IT worker operations:
- Refusal of company-managed devices. The worker insists on using their own hardware — precisely the condition that defeats laptop-farm detection.
- Video-call evasiveness. Cameras off, delayed responses, or claimed audio problems during technical interviews; some candidates have used hidden video feeds.
- Inconsistent identity signals. Résumé details, time-zone behaviour, and payroll jurisdiction that do not line up; reused portfolio work or shared code samples across supposedly distinct candidates.
- Address irregularities. Shipping addresses that resolve to freight forwarders, mail drops, or residences with no obvious connection to the claimed worker.
- Payment routing through third parties. Wages directed to accounts held in different countries or in the names of unconnected individuals — a hallmark of the money-mule layer that funds the operation.
- Reluctance to complete supervised onboarding. Difficulty passing in-person verification, background checks, or supervised test periods run through a managed device.
Liability reaches beyond the worker
U.S. prosecutors framed laptop hosting as conspiracy, wire fraud, and sanctions violations — a theory that treats knowing facilitation as participation in the fraud itself. Anyone who knowingly receives hardware, maintains machines, or launders the resulting income on behalf of an employee whose real identity they know to be false is, on this theory, a participant, not a bystander.
For Hong Kong-based recruiters, staffing agencies, and payment intermediaries in this space, the takeaway is to review their own knowledge-and-benefit exposure under general fraud and money-laundering law — provisions that typically turn on knowledge and benefit rather than on which jurisdiction the laptop sat in. Public reporting on DPRK IT worker schemes, including U.S. Treasury advisories and security vendor investigations, has repeatedly described the corporate-registration layer: shell entities formed in permissive jurisdictions, including Hong Kong and Macau, are used to present a plausible local business face, contract with overseas clients, and route salary payments through layers of payment processors and cryptocurrency. That structure is exactly why hiring diligence that stops at a company name and a bank account can be satisfied by a front.
(Source: BleepingComputer, "FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested.")
據BleepingComputer報道（該網於10月14日報道了此次搜查行動），美國司法部搗破一個以住宅「手提電腦農場」將朝鮮IT工人安插到西方企業的網絡，起訴14人、拘捕兩名嫌疑人——據報其中包括美國公民——並檢獲約187部手提電腦。
行動針對的威脅組織名為「千里馬」（Famous Chollima），這是一個與朝鮮相關的群組，專注非法海外就業而非間諜或破壞性入侵。它與因銀行劫案和供應鏈攻擊而屢上頭條的Lazarus（APT38）及APT37（Reaper）屬不同行動；將三者混為一談，只會模糊這類詐騙的運作方式，以及應如何識別。
「手提電腦農場」如何運作
這個計劃以實體方式運作，而不只存在於網絡。最簡單的形式是：西方企業聘請一名「遙距開發者」，其履歷、英語能力和視像面試都過關，但實際工作者是朝鮮人。關鍵在於，公司發出的手提電腦不會寄到該員工聲稱的地址，而是寄到美國一個住宅地址，由一名受僱的當地協作者拆封、接上本地寬頻連線，再遙距向平壤開放該電腦的連接。結果是：一名朝鮮操作員的流量帶有美國IP地址、身處合理時區，並直接以已登入狀態存取企業憑證、內部工具及原始碼。司法部控罪書正是描述德州住宅地點的這種安排，行動中檢獲約187部手提電腦。
據報，全球朝鮮IT工人計劃所造成的損失已達數十億美元，惟各項估算因方法論不同、以及多少活動從未被偵測而出入甚大。
遙距招聘的警示訊號
由於該計劃牟利的方式是販賣勞動力，而非利用軟件漏洞，因此沒有補丁可打。防範只能依靠程序性的人事控制；以下訊號取自司法部控罪書以及保安供應商和政府對朝鮮IT工人計劃的報告：
- 拒絕使用公司管理的設備。 員工堅持用自己的硬件——這正是令「手提電腦農場」難以被偵測的情況。
- 視像通訊迴避。 技術面試時關閉鏡頭、回應延遲，或聲稱音訊有問題；有求職者更使用隱藏的視像源。
- 身份訊號不一致。 履歷資料、時區行為和發薪司法管轄區互不吻合；不同「候選人」之間重複使用作品集或相同的代碼範例。
- 地址異常。 收貨地址解析為貨運轉運站、郵箱代收點，或與聲稱的員工毫無明顯關聯的住宅。
- 通過第三方收取薪金。 薪金被轉移到其他國家的帳戶，或以不相關人士名義開設的帳戶——這是資助該計劃的「洗錢代理人」層的典型特徵。
- 不願完成受監督的入職程序。 難以通過面對面身份核實、背景審查或以公司管理設備進行的受監督試用期。
責任不止於員工本身
美國檢方將託管手提電腦的行為視為共謀、電匯詐騙及違反制裁——這套法律理論主張，知情地提供協助本身就是參與詐騙。任何人只要明知員工的真實身份是虛假的，仍代為接收硬件、維護機器或清洗所得款項，在此理論下就是參與者，而非旁觀者。
對香港的人力資源顧問、獵頭公司和支付中介而言，要點是檢視自身在一般詐騙及洗錢法下的「知情及獲益」責任——相關條文通常取決於知情與否及是否獲益，而非手提電腦位於哪個司法管轄區。多份關於朝鮮IT工人計劃的公開報告，包括美國財政部的通告和保安供應商的調查，都一再描述其企業登記層：在寬鬆司法管轄區（包括香港和澳門）成立的空殼公司，用以營造一個可信的本地企業形象、與海外客戶簽約，並透過多層支付處理商及加密貨幣轉移薪金。正因如此，招聘審查若只停在公司名稱和銀行帳戶，很容易被一個幌子滿足。
（資料來源：BleepingComputer，〈FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested〉）