40 Laptop Farms Later, Outbound Sourcing Is the Cheaper ID Check

If you hire remote engineers out of an inbound funnel, your ID check is probably verifying the wrong thing. It confirms that a real person matches a document, and North Korean IT worker operations now pay real Americans to be that person.

On Oct 13 and 14, 2026, the Justice Department and FBI announced Operation Lonestar Roundup. It covered more than 40 suspected laptop farms in Texas, raided Sept 21 to 25, plus 14 people charged in a related Ohio indictment. In a new alert the same week, the FBI warned that operatives who land jobs at Western companies are increasingly handing the work to freelancers abroad.

What did Operation Lonestar Roundup actually find?

Lonestar found a spread-out, industrial-scale operation. According to the FBI, that meant more than 40 suspected farms, nearly 190 devices seized and two arrests. The related indictment covers more than 70 US companies and over $3 million in earnings from 2019 to about July 2025.

A laptop farm is a US location where company-issued laptops are kept running so that workers abroad can use them remotely and appear to be at the American address on file. Brett Leatherman of the FBI's Cyber Division announced the numbers. Per the indictment, a shell "software development" firm, Dark Falls LLC, was used in the scheme.

Lonestar isn't the largest case. Here's how it compares with two others that are public:

Divide those figures and you get a few derived numbers. They're my arithmetic, not official figures:

• About 4.7 devices per farm (roughly 187 seized devices ÷ 40 farms, an upper bound since it was "40+" farms). That matches the FBI's observation that operators are running more farms with fewer laptops each to avoid single points of failure.
• About 5 companies per stolen identity in the Arizona case (300 ÷ 60).
• About 50 target companies per persona in the PurpleDelta cluster (1,100 ÷ 22).

Small farms mean busting one barely dents the operation. The fix has to happen before the laptop ships.

Why don't ID checks stop North Korean IT workers?

ID checks confirm that a real person matches a document, and the scheme pays real people to be that person. So it isn't only a document-fraud problem. The person who passed your checks and the person doing the work can be two different people.

Facilitators do more than host laptops. They're paid to appear on camera, sit for interviews, verify fake identities, ship packages, and complete urinalysis or fingerprint submissions. A selfie-plus-ID check passes because a real human with real documents is standing there.

The FBI's latest alert adds a second layer. In its words, "increasingly, North Koreans are obtaining jobs with Western companies and then hiring freelancers to complete work assignments for a fraction of the total salary," usually in Pakistan, India, Nigeria or neighboring countries. That means even a verified identity can front for a freelancer abroad whom nobody vetted.

The staffing-firm route makes it worse. Operatives got roles through IT staffing firms, and end-client devices were redirected to farm infrastructure without the staffing firm knowing. CrowdStrike tracks this group as "Famous Chollima" and helped the FBI on Lonestar. Its finding means the end client inherits every gap in the vendor's process.

The FBI itself says no single red flag reliably identifies these workers. It recommends an "identity in depth" approach and is candid about the cost:

• E-Verify, requiring a US passport, and live identity checks all add friction for legitimate candidates.
• Relying only on name ban lists may block real applicants, and burned personas are simply rebuilt under new names.

All of these controls check the person. None of them check the work history, which is the one thing a facilitator can't lend.

Why does inbound hiring favor the attacker?

Inbound hiring lets the attacker choose you, and at up to 60 applications a day per persona, they only need a tiny hit rate. Every open requisition is an invitation they can answer at scale.

Recorded Future's Insikt Group, in research led by Alexander Leslie, tracked a cluster it calls PurpleDelta. The cluster applied to jobs at more than 1,100 companies using at least 22 fabricated personas. The personas were "supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service."

60

Nisos saw the same pattern firsthand. It set a trap for an operative it called "Jo," who applied to as many as 50 jobs a day while holding three jobs at once.

The funnel numbers follow from that volume. In 2025, Palo Alto Networks found that 90% of one unnamed company's postings had at least one North Korean in the applicant pool. That figure is a year old and from a single company, but the mechanism hasn't changed. Gartner projects that by 2028, 1 in 4 candidate profiles worldwide could be fake, and 6% of candidates it surveyed said they had participated in interview fraud.

So the hard part of candidate identity verification in recruiting is the inbound funnel itself. You're asking a recruiter to catch the fake among hundreds of real applicants, every time, while the attacker gets unlimited attempts. Your recruiter has to win every round, and the attacker only has to win once.

Why is a polished GitHub profile part of the fake?

A polished GitHub profile is standard kit for these operations, so polish proves nothing. Age, and collaborators you can find on your own, are what count.

HCA lists "a perfect CV, a polished GitHub profile and a referee who cannot be traced to a real employer" as the typical package. KnowBe4 hired one of these operatives, who then tried to load malware onto a company laptop. Polish got the operative through the door.

The mechanism comes down to cost. A clean profile and tidy READMEs are cheap to produce when your personas already come with custom ChatGPT assistants. Years of history woven into other people's work is far harder to fake:

• Time. History has to accumulate. Nisos notes that when a persona is exposed or loses a job, operators "begin the job search again by building new identities." Every burned persona restarts at zero.
• Other people. Pull requests merged into someone else's project, issues answered on a repo you don't own, a conference talk with a named co-presenter. All of these need real third parties to cooperate, publicly, over years.
• Consistency across platforms. The GitHub handle, the talk bio, the former employer and the people who worked there all need to point at each other.

Self-supplied references fail this test too. Nisos observed the workers managing job references for each other. A referee the candidate hands you is a claim. A former teammate you found yourself, through a shared repo or a shared employer, is evidence.

A facilitator can lend you a face. Nobody can lend you years of commits alongside people who still answer email.

How does outbound sourcing flip verification?

Outbound sourcing starts from evidence instead of claims. You find the engineer through years of public work first, then confirm the person matches the work, rather than starting from a résumé and trying to disprove it.

Outbound sourcing means identifying and approaching candidates yourself, rather than waiting for them to apply. On fraud, its advantage is structural, not cosmetic:

1. You pick them. A persona sending 60 applications a day never enters your pipeline because you never opened one to it.
2. The evidence comes first. You shortlisted the person because of a contribution history, a talk or a colleague network. Verification is mostly done before the first message.
3. The cost lands on the attacker. To be found by outbound search, a fake would need years of cross-linked public work, and that's exactly what burned and rebuilt personas lack.

The historical bottleneck has been effort, and recruiters are already spending it in the wrong place.

2 in 3

That hour goes on candidates who picked you, checking documents a facilitator can pass. Spent at sourcing instead, it does double duty: reading someone's contribution history tells you whether they're real and whether they're good. The catch is that building an evidence-first shortlist by hand means cross-referencing GitHub, LinkedIn and conference archives for every role. That's the gap Refolk closes: you describe the engineer in plain English and get back people whose public work across GitHub, LinkedIn and the open web already supports the claim.

One caveat matters. Outbound doesn't make identity checks unnecessary. Someone could still impersonate the real engineer you found. So contact people through channels tied to their history, such as the email on their commits or the profile linked from their talk page. Then run your normal identity checks on the person who shows up. What changes is the order. You confirm the work exists before you confirm the face, and the face has to match a body of work you found yourself.

What belongs on a provenance checklist for remote engineers?

A provenance checklist confirms that the person, the work history and the colleagues all point to each other, before the offer and after the laptop ships. Here's the version I'd use to verify a software engineer candidate's background, built from what the FBI, CrowdStrike, Mandiant and Nisos have published.

Before outreach or interview

1. History that predates the role by years. Contributions, talks or publications going back well before this job search, not a burst from the last six months.
2. Work inside other people's projects. Merged PRs and review threads on repos the candidate doesn't own count for more than their own pinned repos.
3. Collaborators you can find on your own. At least two people who shared a repo, a talk or an employer with the candidate, found by you rather than supplied by them.

Before the offer

1. Location claims that hold together. Mandiant flagged US addresses paired with overseas degrees that companies "typically don't verify." Check the education and the address together.
2. Your own references, not theirs. Contact the collaborators from step 3 directly and ask about the work, not just the dates.
3. The interviewee and the contributor are the same person. Have them walk through a specific past PR or design decision live, in detail only the author would know.

Mapping that colleague graph for steps 3 and 5 is the slow part. Describing it to Refolk in plain English, for example engineers who contributed to a named repo or worked at a named employer, gets you a list to check against instead of a blank page.

After the hire

1. No last-minute address changes before equipment ships.
2. No "stolen laptop" replacements to a new address in the first months.
3. No KVM switches or remote-desktop tools on company devices without a documented reason. CrowdStrike and the FBI both flag these as farm signatures.

For staffing vendors

1. Contract your standards onto the vendor. If an IT staffing firm places the engineer, require that it runs the same provenance checks and gives you evidence it did. Lonestar showed that a vendor's blind spot becomes yours.

FAQ

How do you spot North Korean IT workers in hiring?

No single signal works. The FBI says so explicitly and recommends "identity in depth." The strongest pre-hire signals are thin public history that starts recently, references only the candidate can connect you to, and location claims that don't fit together, such as a US address with an unverified overseas degree. After hiring, watch for address changes before equipment ships, laptop "theft" replacements, and KVM or remote-desktop tools on company devices.

Does outbound sourcing replace ID verification?

No. It changes the order and moves the burden onto the attacker. You still verify identity, but you verify a person you found through years of independently checkable work, contacted through channels tied to that work. That closes the gap that facilitator-passed ID checks and subcontracted freelancers exploit, because the work history can't be borrowed the way a face can.

Are name ban lists or requiring a US passport effective against laptop farm fraud?

They help at the margin, but the FBI warns that they add friction for real candidates. Name lists can also block legitimate applicants while operators rebuild under new identities, as Nisos documented. Passports and live checks confirm a person, and facilitators are real people paid to pass them. Use these controls as one layer. Never let them be the only one.