US raids 40 laptop farms for North Korean IT workers

United States authorities have arrested two Americans, accused of hosting company laptops for North Korean IT workers, the US Department of Justice announced.

The two arrested are named as Michael James Bostelle of Pennsylvania, and Juan Cecilio Pena Carillo of Texas.

They face four charges of alleged wire fraud, money laundering and identity theft.

US prosecutors allege the pair received laptops issued by victim companies on which the two installed remote access software, and moved the IT workers' wages to accounts controlled by North Korea.

In September, the US Federal Bureau of Investigation (FBI) seized 187 devices and keyboard, video, mouse (KVM) devices in raids on suspected laptop farms across Texas in Operation Lonestar Roundup.

The IT workers reached some 70 US employers in sectors such as health care, communications, retail, manufacturing and support, with the scheme generating  a relatively modest US$3 million.

Security vendor CrowdStrike, which said it assisted the FBI and tracks the group as Famous Chollima, said operatives had gone to considerable lengths to steer hardware towards the farms.

Some filed fraudulent police reports claiming a laptop had been stolen, prompting employers to ship replacements to farm addresses.

Others announced last-minute relocations to divert devices already in transit.

While it saw disruption operations such as the current one as "critical", Crowdstrike added that it is unlikely to create long-lasting effects.

"The adversary will almost certainly continue to evolve their methods to evade law enforcement discovery and disruption," Crowdstrike said.