GoKawiil
Tech News
The FBI conducted searches at more than 40 residences across Texas and filed charges against American facilitators accused of helping North Korean workers secure remote US jobs using stolen or fabricated identities. Investigators say the scheme funneled millions of dollars in wages back to North Korea, with the Americans allegedly running 'laptop farms' to make it appear the workers were logging in from US locations.
The Department of Justice disrupted operations tied to Famous Chollima, a North Korean threat group, arresting two suspects and charging 14 individuals. The FBI's 'Lonestar Roundup' operation searched 40 Texas residences between September 21-25, seizing about 187 laptops and KVM devices used to run so-called laptop farms that let North Korean IT workers appear to be based in the US.
The FBI, working with CrowdStrike, shut down more than 40 laptop farm operations in Texas used to run fake remote-worker schemes, seizing over 200 devices. No arrests were made immediately, as authorities moved to disrupt the operations quickly rather than wait for formal charges, though they warned participants of possible future criminal penalties.
The Department of Justice says it has indicted and arrested two Americans and seized over 180 computers from more than 40 laptop farms across Texas, which North Korean operatives allegedly used to remotely access jobs at U.S. companies under stolen identities. Prosecutors say at least 70 companies across 17 states and DC—spanning healthcare, retail, manufacturing and other sectors—were infiltrated, generating roughly $3 million in illicit proceeds.
Security researchers from Genians, Proofpoint, Digital Security Lab Ukraine and Enki White Hat report that North Korean state-linked hacking groups, including one tracked as TA406 (also known as Konni or Opal Sleet), have been spear-phishing Ukrainian government, policy and academic targets since at least February 2025. The campaign aims to gather intelligence on Ukraine's wartime position after North Korea began sending 14,000 to 15,000 troops to support Russia in October 2024.
Blockchain data platform Chainalysis found that attacks using 'Blockchain Dead Drops' — a technique storing malware payloads or command-and-control configuration data on public blockchains — grew more than fivefold over the past year. The report attributes much of the increase to North Korean and Iranian state-linked actors and Russian-speaking criminal groups, and notes a 440% rise tied to wider availability of Chinese open-source AI tools.
Bitget CEO Gracy Chen said a September 24 breach that drained $387.5 million from the exchange showed signs of North Korean state-sponsored hackers, pointing to VPN infrastructure previously linked to such groups. Attackers exploited a backend wallet system, forging transfer approvals to authorize fraudulent withdrawals, while cold wallets and private keys stayed secure. Bitget froze withdrawals temporarily and said its $464 million User Protection Fund would cover the entire loss.
Crypto exchange Bitget disclosed a $388 million security breach and said it is 'very likely' the work of North Korean hackers. The company stated that user private keys were not compromised and that a bitcoin-backed protection fund will cover the losses, while withdrawals remain frozen pending an investigation.
Security firm Nisos ran a sting on a suspected North Korean operative who applied for a remote AI engineering job, sending a surveilled laptop to a US 'laptop farm' in Florida. Over subsequent months Nisos tracked the operator communicating with 22 others and four US-based facilitators while connecting from near the North Korea-China border. A joint advisory from US, Japan, Australia and Germany law enforcement says the broader campaign, called WaterPlum or Contagious Interview, has infected over 30,000 devices in 100+ countries and drained more than 7,000 crypto wallets.
Authorities in Australia, Germany, Japan and the US say a North Korean hacking group known as WaterPlum has compromised over 30,000 devices and 7,000 crypto wallets by posing as recruiters and sending malware-laced coding tests to tech workers. The scheme has netted at least $10.71 million in cryptocurrency, funneled back to North Korea.
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
A joint advisory from law enforcement in Japan, the US, Australia and Germany says the North Korean-linked group WaterPlum infected over 30,000 devices across more than 100 countries between December 2025 and July 2026. The hackers drained more than 7,000 cryptocurrency wallets and moved over $10.7 million worth of crypto assets to North Korea, using fake job interviews and malicious code disguised as coding tests or software projects to infect victims.