DOJ Seizes 187 Devices in Raids on 40+ Laptop Farms Tied to DPRK IT Worker Fraud Across 70 Firms

Court filings detail how U.S. and Chinese nationals set up shell entities like Dark Falls LLC, opened bank accounts, and hosted company laptops with remote KVM access to mask overseas workers as domestic employees. The operation generated roughly $3 million routed to Pyongyang in violation of sanctions. Evidence includes procurement records showing repeated use of fake identities on platforms serving defense-adjacent sectors. The pattern matches prior Famous Chollima and Wagemole activity documented in CrowdStrike and Mandiant reports, where revenue directly supports DPRK weapons programs. Official statements emphasize sanctions enforcement, yet independent technical indicators—IP traces and device seizure logs—reveal the scheme's scale exceeded public indictments by relying on uncharged U.S. recruiters. Mandatory contractor training requirements will now incorporate device-location verification and behavioral analytics checks. DoD and cleared industry personnel face new audit protocols that directly alter hiring workflows and remote-access policies. Next phase targets unindicted facilitators and financial rails; expect expanded CISA guidance on laptop-farm indicators within 60 days.