Executive Summary

Last week’s reporting combined a large U.S. disruption of North Korean remote IT-worker infrastructure with new detail on how the scheme is changing. Federal authorities charged 14 people, arrested two alleged facilitators, searched more than 40 suspected Texas laptop farms, and seized about 187 devices. The FBI also warned that the workers are spreading devices across smaller farms, subcontracting jobs, and paying third parties for interviews, identity checks, and in-person tasks.

Kimsuky activity covered both ransomware delivery and espionage. AhnLab traced Funhouse ransomware from a resume-themed HWP document through scripts, a Python backdoor, and Quasar RAT. Qihoo 360 documented a separate campaign that used malicious shortcuts and a tampered Python repository. Security Alliance reported cryptocurrency losses tied to compromised trusted systems, fake meetings, and access retained long after the initial lure.

Key Trends

1. Law enforcement targeted the domestic infrastructure behind remote IT work

The U.S. Department of Justice announced charges against 14 people and the arrests of two alleged U.S.-based facilitators in a scheme that affected more than 70 companies and generated over $3 million. During Operation Lonestar Roundup, the FBI searched more than 40 known or suspected laptop-farm locations in Texas and seized about 187 laptops and KVM devices. The department said facilitators received employer hardware, installed remote-access tools, and helped transfer earnings to DPRK-controlled accounts.¹

CrowdStrike said its work with the FBI identified personas, technical indicators, facilitator networks, and U.S.-based computers supporting Famous Chollima between April 2025 and June 2026. The affected clusters reached dozens of organizations across sectors that included aerospace, energy, financial services, healthcare, cybersecurity, and defense engineering. CrowdStrike also observed workers diverting replacement laptops, hiding remote-management tools, and reusing spoofed device identifiers across separate victim organizations.²

The raids reached the physical infrastructure behind the worker personas presented to employers. A residential address, hosted laptop, and local network connection allowed an overseas operator to pass location checks and work through an employer-issued device. Seizing that equipment removes active access and preserves evidence that can connect multiple identities and employers to the same facilitator.

2. The IT-worker scheme spread tasks across more people and locations

The FBI reported that North Korean IT workers are recruiting Americans and foreign freelancers for a wider range of tasks. These include appearing on camera, taking part in interviews, verifying identities, shipping packages, completing drug tests or fingerprint submissions, and keeping employer devices online. Some workers subcontract entire jobs to freelancers in South Asia or West Africa, while laptop farms are becoming more distributed, with fewer devices at each location.³

The advisory also described escalation after detection. Workers have extorted companies with stolen data, threatened former managers and their families, and paid U.S.-based facilitators to make in-person threats. They have sought cleared defense-contracting positions and recruited active-duty military personnel to host laptops.³

The FBI recommends layered identity checks across hiring and employment because individual signals overlap with legitimate remote work. Useful combinations include rapid turnover in addresses or financial accounts, identity-document discrepancies, unexpected remote-access tools, KVM-over-IP hardware such as PiKVM or TinyPilot, and data transfers associated with mandatory screen recording. Those checks need review by people who can distinguish a fraud pattern from an isolated anomaly.³

Vertex Project and Team Cymru built a hunt around a multi-hop pattern documented in earlier reporting. They assessed with high confidence that a U.S. residential host at 172.120.254[.]49 supported the broader DPRK IT-worker ecosystem. The host exposed HTTP and SOCKS proxies plus SSH, accepted connections from Astrill VPN addresses, and appeared in repeated traffic sequences from a North Korean IP through an Astrill endpoint to the residential proxy. One sequence on May 8 placed the two hops 76 seconds apart.⁴

3. Kimsuky paired familiar tooling with new delivery paths

AhnLab traced a Kimsuky chain that began with a resume-themed HWP document. Opening the document created a VbsEdit executable and manifest in the temporary directory. A link inside the document then triggered batch, VBS, and PowerShell stages, followed by a Python backdoor, Quasar RAT, and Funhouse ransomware. The Quasar RAT configuration reused a mutex from earlier Endpoint ransomware cases, while Funhouse retained the June variant’s .Funhouse extension, HC-128 encryption, footer format, and ransom-note filename.⁵⁶

The delivery method changed from the malicious shortcuts seen in earlier cases to a hyperlink inside a familiar document. Execution still depended on the recipient clicking that link, but the payload chain reused scripts and Quasar RAT traits that AhnLab had already connected to Kimsuky.⁵⁶

Qihoo 360 attributed a separate multi-path campaign to Kimsuky. One path used malicious LNK files disguised as insurance and financial documents, then ran PowerShell and scheduled tasks. Another cloned the pybroker repository and placed a backdoor in conftest.py, causing pytest to execute it. The chain used certutil, curl, and public GitHub repositories to retrieve components and steal host, account, network, and document data.⁷

AhnLab’s September review placed these cases beside continued Contagious Interview, PolinRider, and Konni activity. Its review described fake recruitment and coding assignments delivering OtterCookie, compromised GitHub accounts spreading poisoned repositories, and VelvetCake collecting host information and screenshots. GitHub, WordPress, Dropbox, and Pinggy divided delivery and command functions across legitimate services.⁸⁹

4. Trusted systems and fake meetings remained routes to cryptocurrency loss

Security Alliance assessed that DPRK-linked actors accounted for roughly 95% of the losses in its third-quarter review when public reporting was included. The two largest thefts, Bitget and AFX Trade, were publicly attributed to TraderTraitor/UNC4899. In both cases, attackers compromised trusted infrastructure involved in transaction approval rather than directly stealing private keys. The review also recorded persistent fake-recruitment, supply-chain, and fake-meeting activity against cryptocurrency organizations.¹⁰

The next weekly incident report recorded $655,000 in DPRK-related losses. A fake Microsoft Teams call associated with UNC1069 led to a $385,000 loss, and a separate seed compromise with suspected DPRK involvement caused a $270,000 loss. Security Alliance published three phishing domains and linked older command infrastructure to newer UNC1069 deployments.¹¹

The quarterly data also showed why a clean endpoint after an interview or meeting is not enough to close an investigation. Security Alliance recorded delays from initial access to theft ranging from days to more than a year. Reviews should cover old access tokens, personal access tokens, repository changes, wallet-approval systems, and backdoors that may have outlived the original lure.¹⁰

What to Watch

Employers should connect hiring evidence with endpoint, network, payroll, and shipping records. Repeated device identifiers, address changes during onboarding, remote-control software outside the job role, and multiple personas using one local network deserve joint review. Companies should also preserve evidence before disabling accounts because a single laptop or facilitator may connect activity across several employers.

For developer and cryptocurrency teams, treat an HWP link, coding assignment, repository test, and meeting installer as possible execution paths. Inspect test configuration and editor automation before running external projects. After a suspected compromise, review transaction-approval infrastructure and dormant credentials as well as the device that opened the lure.

Reports Reviewed