Threat IntelligenceInsider ThreatObichat
The U.S. Department of Justice has charged 14 people and the FBI has seized about 187 laptops and KVM devices in an operation against North Korean remote IT worker schemes. According to BleepingComputer, the Texas action, codenamed "Lonestar Roundup", involved searches of 40 residences suspected of hosting laptop farms between September 21 and 25. Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested.
The scheme depends on an ordinary-looking U.S. presence. Operatives use stolen or fabricated identities to get hired as remote workers. U.S.-based facilitators then receive the company-issued laptop at their home, install remote-access software, and keep the device online so the worker appears to be logging in from inside the country. VPNs and proxy infrastructure cover the rest, and earnings are moved to accounts controlled by DPRK actors.
CrowdStrike describes several ways laptops get diverted to a farm:
CrowdStrike also reports that after public exposure, operatives increasingly spoofed device identifiers or reused identifiers across victim organisations. It expects limited near-term impact from this operation but calls it the start of a broader effort against Famous Chollima's U.S. infrastructure.
A farm laptop is a fully trusted corporate endpoint controlled by someone outside the company. Whatever the worker can reach, so can whoever operates the remote-access tooling. The risk is data theft and extortion as well as salary fraud, which is why this class of case belongs with insider-threat and access reviews.
Obichat is Obiguard's managed chat workspace, with workspace and team isolation. For distributed or contract teams, it lets people use AI models inside a scoped workspace under the organisation's policies, rather than pasting source code, customer data or internal documents into whatever tools sit on a laptop. Access is granted per workspace and can be removed in one place, and activity is attributable to a named member.
It is not an identity-proofing or hiring control and will not tell you a worker is not who they claim to be, nor stop someone with a legitimately issued laptop from reaching other systems. What it limits is how much sensitive context a new remote hire can reach through AI-assisted work by default.
If one of your remote hires from the last two years turned out to be an operator overseas working through a laptop in someone's spare room, how much of your data could they reach, and would you know?
See how Obichat works or talk to us about scoping AI access for remote and contract teams.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →