North Korean 'Laptop Farm' Operation Netted $17 Million Through Unwitting American Accomplice (wsj.com) 55
A former Minnesota waitress unknowingly helped North Korean workers steal $17.1 million in wages from over 300 American companies through an elaborate remote work scheme, federal prosecutors said this week. Christina Chapman operated a "laptop farm" from her home, managing dozens of computers that allowed North Koreans using stolen U.S. identities to work as legitimate tech employees.
The FBI estimates this broader infiltration involves thousands of North Korean workers generating hundreds of millions annually for the sanctions-hit regime. Chapman, recruited via LinkedIn in 2020 to serve as "the U.S. face" for overseas IT workers, handled logistics including receiving company laptops, installing remote access software, and processing falsified employment documents.
The North Korean workers accessed the devices daily from overseas, with some maintaining jobs for months or years at major American corporations. Chapman earned just under $177,000 before the FBI raided her Arizona operation in October 2023, seizing over 90 computers. She pleaded guilty in February to wire fraud, identity theft, and money laundering charges, facing up to nine years in prison at her July sentencing.
The FBI estimates this broader infiltration involves thousands of North Korean workers generating hundreds of millions annually for the sanctions-hit regime. Chapman, recruited via LinkedIn in 2020 to serve as "the U.S. face" for overseas IT workers, handled logistics including receiving company laptops, installing remote access software, and processing falsified employment documents.
The North Korean workers accessed the devices daily from overseas, with some maintaining jobs for months or years at major American corporations. Chapman earned just under $177,000 before the FBI raided her Arizona operation in October 2023, seizing over 90 computers. She pleaded guilty in February to wire fraud, identity theft, and money laundering charges, facing up to nine years in prison at her July sentencing.
Every IP Address Range.... (Score:1)
Re: (Score:2)
It's difficult to cut them off with China and Russia enabling their behavior.
Hard to believe that anyone would be stupid enough to fall for being a NK laptop minder though. It's not a matter of IF you'll get caught, but WHEN.
Re: (Score:3)
Let's not confuse greed with stupidity.
Re:Every IP Address Range.... (Score:4, Insightful)
Re: (Score:2)
I would be curious if there's also some polished psychological work in getting people onboard; or if they go with a relatively u
Black mail? (Score:3)
either start them with some slightly sketchy but not super bad 'work from home $$$' then, once they already start to feel implicated, introduce the fact that you will also be fudging I-9s; or just open with "This is a remote working scam; if you don't like that walk away but you don't know who I am" and then use whoever doesn't walk away.
You forgot an additionnal option:
Increase the sketchiness of the task assigned.
Once the mark raise suspicion, answer "Yes, that's indeed a scam. If you don't like that, we could tell the police all the fine details of what you've done up to this point.... Or you could just shut up, abstain from asking to many question and the money will keep coming in."
Re: (Score:2, Insightful)
Many companies already DO block NK/Iran/etc address space at their border router. That's precisely why they were using some patsy to host these laptops on their home broadband connection in the US.
Re: (Score:2)
Obviously an officially NK IP isn't going to cut it; and for anyone who is paying the slightest attention to the VPN or cloud service IdP even an American AWS or random colo IP isn't going to be a convincing substitute for something in AS7922 that geolocates to roughly the right location(if they are claiming to live in an area with Comcast service); but based on the rep
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Interesting take...
Can you list a few countries that would meet that standard? Seems like it'd be a pretty empty internet.
Re: (Score:2)
Belonging to the nation of NK, should be totally cut off from the wider world
North Korea net access is mostly via proxies in China using resources of legitimate ISPs.
In trying to promote freedom of access to information for Chinese citizens, we in the west have made it very easy for a Chinese IP address to connect to western hosted VPNs -almost no questions asked. The CCP takes advantage of this. Why do you think they don't just block access to western-hosted VPNs? They are officially disallowed, but... everyone knows how to do it. The government can hide their agent's activitie
Re: (Score:2)
Re: (Score:2)
One guy explained that the firewall was just a soft block and without VPNs, it would be Impossible to do business with the rest of the world.
The idea I get is that most people like the firewall because you have to actively circumvent it to be flooded by American style hate news (read any news site. They are nonstop hate streams) and pornography. Like "ok... I'm read
Re: (Score:1)
compare NK to Israel. .Israel is far far worse yet gets preferential treatment.
No, MORALITY is a false scale being used in the United States to justify nonsense.
Paid her poorly... (Score:5, Insightful)
If she was only paid 177k for nearly 4 years of work that's not a great salary...
The term "steal" is not entirely appropriate either, "fraudulently obtained" would be more accurate. After all the companies willingly paid the money, and the workers carried out the work expected of them to a high enough standard otherwise they'd have been fired.
Re: (Score:2)
In my experience, the overhead costs of firing people are usually high enough that "high enough" is a dismayingly low threshold.
Re: (Score:2)
Most employees have a probationary period where it's trivially easy to terminate someone if they're not up to the standard expected.
Yes the threshold is often alarmingly low, but this is less to do with the difficulty of firing and more to do with the difficulty of replacement.
Re: (Score:2)
People on the internet constantly complain that companies have no loyalty and will fire you at the drop of a hat, and companies never fire anyone for poor performance, and I suspect it is the same people often saying this.
Re: (Score:2)
What "overhead" costs are there to firing a remote worker in another country?
Corporations don't seem hesitant to fire even US workers on the slightest whim.
Re: (Score:2)
You may consider that poor pay if she was working 40 hour weeks keeping those laptops turned on, but it's better than minimum wage (possibly still true after costs, I haven't tried to research Minnesota electricity prices) and in reality probably didn't require 40 hour weeks. More like monthly reboots and occasionally installing a new laptop when they delivered it to her.
Re: (Score:2)
I am confused.
TFS says "Minnesota waitress" but then refers to her "Arizona operation" containing over 90 computers.
Re: (Score:2)
I mean that's not a bad side gig. Most people could have their house paid off with it.
Re: (Score:1)
It sounds like they were good workers and were paid appropriately by US companies who just outsourced the work and were happy to have the work done.
No different than outsourcing to any other cocountry except the PRK is on the "bad country" list.
archival link (Score:2)
https://archive.is/E5uNA [archive.is]
and now all the source code and other docs may be (Score:3)
and now all the source code and other docs may be in open court?
Not just fraud ... (Score:5, Informative)
While the headline frames this as a quirky “laptop farm” scam, the DOJ filings show it’s far more serious:
- This wasn’t a typical remote-work fraud. It was a structured operation involving North Korean IT workers, false identities, and money laundering, with explicit goals of evading sanctions and funding the DPRK regime.
- Over 300 U.S. companies, including Fortune 500s, were unknowingly infiltrated. Some of the targets were strategic industries (aerospace, media, finance).
- Workers didn’t just "do the job", they did it under stolen identities, triggering false tax liabilities and access to internal systems, with implications for both data security and federal compliance.
Calling this “just wage theft” is like calling a phishing campaign "email misunderstandings." It misses the real issue: this was a nation-state operation masked as freelance tech work.
https://www.justice.gov/usao-d... [justice.gov]
https://www.justice.gov/usao-d... [justice.gov]
Re: (Score:2)
Trump loves North Korea.
Dictators stick together.
He'll probably pardon her.
Still software? (Score:2)
That's not something you try to keep an eye on specifically because Bob from Accounting might secretly be Bob from Accounting from Pyongyang; but because endpoint malware generally is a fairly common risk; and (usually social-engineering driven, just fullscreening a browser with some scary text about how you've been haxx0red and need to call Microsoft support i
Re: (Score:2)
Wouldn't you use some type of KVM to network for your remote access?
The computer wouldn't have any way to know.
Re: (Score:2)
As I noted; a proper network KVM would be essentially invisible and relatively low effort(you couldn't necessarily just grab something off the shelf; unless they are pure desktop/laptop or young enough to have known only 'cloud', IT might well no
Re: (Score:2)
I just assumed sloppy journalism wording.
The person sets up the KVMs and manages making sure they can be connected to remotely.
Re: (Score:2)
Nothing unwitting about it (Score:5, Insightful)
Remember folks the only reason your boss hasn't killed you and sold your organs is because it's not legal but yet.
Re: (Score:2)
Re: (Score:2)
It's funny this is supposed to be a science and technology forum but even basic mathematics is too much for a lot of people here.
Re: (Score:2)
They wanted cheap labor and they got it. But if you get caught hiring people from hostile foreign Nation then have to pretend you're the victim.
Remember folks the only reason your boss hasn't killed you and sold your organs is because it's not legal but yet.
Correction good sir, the only reason your boss hasn't harvested and sold your organs is because he might still get punished if caught. That is slowly changing, at least in the US.
Ha! (Score:5, Funny)
She should have stolen classified documents and kept them in her bathroom.
Unwitting? (Score:3)
Re: (Score:2)
nine years (Score:1)
Re: (Score:3)
Re: (Score:1)
No it wouldn't. I would look up the case, but TFA is adwalled and/or paywalled
Where are NKs 99 other laptop farms? (Score:2)
Re: (Score:2)
When is the FBI going to track the rest down?
They are far too busy for such menial and pointless investigative work. There are far far more pressing matters to look into, like who dropped a baggie of coke in the White House reception room, and who leaked the per-determined result of the Dobbs case. You know, the heavy-hitting stuff. [reuters.com]
Slashdot fail again (Score:2)
Rich target for humor again finds none on Slashdot. Details at 11.
I wanted to see this story as evidence the FBI was still functional in some constructive sense, but turns out this is old news. Does anyone know if the new director is still permitting this sort of investigation? The YOB could get dragged in via his crypto bros. Recently heard some reporting about how that special dinner was handled. The biggest buyers of his "special" coins had a private reception and personal meeting with him, followed up w
Not exactly stealing (Score:2)
While some were fired early, some also stayed on for months/years and were clearly doing the job they were being paid for to an acceptable enough level to pass muster.
The missing aspect of trhis story (Score:2)
She settled - that means, the prosecutors probably threatened her with unreasonably strong and inappropriate charges that she probably didn't understand, so that she'd settle for the appropriate charges, and the prosecutors get to avoid a trial. That aspect is rarely covered in these stories. A lot about this case could have been revealed by a court case. But a persistent conspiracy to short circuit that process keeps that from happening with regularity. Justice my ass.