GoKawiil
Tech News
The FBI conducted searches at more than 40 residences across Texas and filed charges against American facilitators accused of helping North Korean workers secure remote US jobs using stolen or fabricated identities. Investigators say the scheme funneled millions of dollars in wages back to North Korea, with the Americans allegedly running 'laptop farms' to make it appear the workers were logging in from US locations.
The Department of Justice disrupted operations tied to Famous Chollima, a North Korean threat group, arresting two suspects and charging 14 individuals. The FBI's 'Lonestar Roundup' operation searched 40 Texas residences between September 21-25, seizing about 187 laptops and KVM devices used to run so-called laptop farms that let North Korean IT workers appear to be based in the US.
The FBI, working with CrowdStrike, shut down more than 40 laptop farm operations in Texas used to run fake remote-worker schemes, seizing over 200 devices. No arrests were made immediately, as authorities moved to disrupt the operations quickly rather than wait for formal charges, though they warned participants of possible future criminal penalties.
The Department of Justice says it has indicted and arrested two Americans and seized over 180 computers from more than 40 laptop farms across Texas, which North Korean operatives allegedly used to remotely access jobs at U.S. companies under stolen identities. Prosecutors say at least 70 companies across 17 states and DC—spanning healthcare, retail, manufacturing and other sectors—were infiltrated, generating roughly $3 million in illicit proceeds.
Security researchers from Genians, Proofpoint, Digital Security Lab Ukraine and Enki White Hat report that North Korean state-linked hacking groups, including one tracked as TA406 (also known as Konni or Opal Sleet), have been spear-phishing Ukrainian government, policy and academic targets since at least February 2025. The campaign aims to gather intelligence on Ukraine's wartime position after North Korea began sending 14,000 to 15,000 troops to support Russia in October 2024.
The FBI has repeatedly flagged that North Korean IT workers are using fraudulent or stolen identity documents, proxy infrastructure and US-based facilitators to pass remote hiring processes and gain access to corporate networks. Rather than stealing existing credentials, these attackers get organizations to create new credentials for them during onboarding, exploiting the fact that Zero Trust and MFA controls assume an identity already exists. The FBI now recommends verifying identity both during hiring and continuously throughout remote employment.
Blockchain data platform Chainalysis found that attacks using 'Blockchain Dead Drops' — a technique storing malware payloads or command-and-control configuration data on public blockchains — grew more than fivefold over the past year. The report attributes much of the increase to North Korean and Iranian state-linked actors and Russian-speaking criminal groups, and notes a 440% rise tied to wider availability of Chinese open-source AI tools.
Bitget CEO Gracy Chen said a September 24 breach that drained $387.5 million from the exchange showed signs of North Korean state-sponsored hackers, pointing to VPN infrastructure previously linked to such groups. Attackers exploited a backend wallet system, forging transfer approvals to authorize fraudulent withdrawals, while cold wallets and private keys stayed secure. Bitget froze withdrawals temporarily and said its $464 million User Protection Fund would cover the entire loss.
Bitget has reopened Bitcoin withdrawals after suspending them following a breach it says North Korean hackers carried out last week, stealing $387.5 million across multiple chains and tokens. The exchange plans to phase back withdrawals for ETH, USDT and other assets by early October, saying it has fixed the exploited vulnerability and that user balances remain unaffected thanks to its Protection Fund.
Crypto exchange Bitget disclosed a $388 million security breach and said it is 'very likely' the work of North Korean hackers. The company stated that user private keys were not compromised and that a bitcoin-backed protection fund will cover the losses, while withdrawals remain frozen pending an investigation.
Security firm Nisos ran a sting on a suspected North Korean operative who applied for a remote AI engineering job, sending a surveilled laptop to a US 'laptop farm' in Florida. Over subsequent months Nisos tracked the operator communicating with 22 others and four US-based facilitators while connecting from near the North Korea-China border. A joint advisory from US, Japan, Australia and Germany law enforcement says the broader campaign, called WaterPlum or Contagious Interview, has infected over 30,000 devices in 100+ countries and drained more than 7,000 crypto wallets.
Cryptocurrency exchange Bitget said hackers stole more than $351 million from its hot wallets in a Thursday cyberattack, making it the largest crypto theft of the year. The exchange has suspended withdrawals and said its $464 million user protection fund should cover losses, though CEO Gracy Chen did not give a timeline for restoring withdrawals.