What We Missed: Feds Lasso Texas Laptop Farms

In this video, Dark Reading editors discuss some of the news they didn’t get a chance to cover, from busting up North Korea’s stateside infrastructure in “Operation Lonestar Justice” to Staples’ gift card bonanza.

The US government is striking back against the ever-persistent threat of fake IT worker schemes run by the Democratic People’s Republic of Korea (DPRK).

In this episode of “What We Missed,” Dark Reading’s Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn’t make it into the publication, starting with FBI raids across more than 40 residences in Texas that were allegedly running “laptop farms.”

The law-enforcement action, dubbed “Operation Lonestar Roundup,” seized 187 devices, charged 14 people, and arrested individuals accused of facilitating North Korean threat actors running fake IT worker schemes. The schemes disrupted by Operation Lonestar Roundup impacted more than 70 US companies, according to the FBI.

Fake IT workers schemes typically involve DPRK actors masquerading as IT professionals and developers, either using fake or stolen identities, to gain employment at US companies. The threat actors then use their positions to exfiltrate sensitive data, steal intellectual property, and gather intelligence.

Also discussed on this episode: Russian police arrested alleged members of a cybercriminal group known as the “DataSuckers,” which has taken credit for several breaches against companies in Russia and Ukraine; and according to a report from 404 Media, a Chinese criminal operation breached Staples’ internal customer support system and used it to issue thousands of gift cards, worth $5 million.

For all of our Dark Reading news videos, please check out our YouTube channel and our curated video articles.

What We Missed With Rob Wright & Alex Culafi: Full Transcript

This transcript has been edited for clarity and length by Informa TechTarget’s internal AI assistant. For the full experience, please watch the video.

Dark Reading’s Rob Wright: Hi, I’m Rob Wright with Dark Reading.

Dark Reading’s Alex Culafi: And I’m Alex Culafi with Dark Reading.

DR’s Rob Wright: And this is “What We Missed,” a discussion about some of the recent headlines we did not get a chance to cover in the pages, pods, or videos of Dark Reading. Alex, this is an eventful one. We don’t have any real AI news, so that’s good. We get a break from AI news.

DR’s Alex Culafi: Yep.

DR’s Rob Wright: But we’ll kick it off with an interesting one. So there was a big federal crackdown on North Korean IT worker schemes. There was a raid, a laptop farm in Texas. An interesting one. An interestingly titled operation. Busted a bunch of laptop farms. And yeah, it seems like the government is getting into the business of trying to take down these North Korean IT worker schemes. What’d you think of this?

DR’s Alex Culafi: I think this is an issue that will persist for a while, which isn’t very specific. But I guess I’m thinking about … I was watching something about this on YouTube the other day, even, and it was about a woman who was an office worker — I think this was back in like 2024 — who had gotten hired for a job, and she was just like a normal, nice, well-intended Southern lady. And they were sending her laptops and she thought she was just doing her job and then it turns out that she was hooking up dozens of laptops. And later on in the video I think it sort of went into maybe she knew more than she was letting on at first.

DR’s Rob Wright: Right.

DR’s Alex Culafi: But I do think, especially in times of economic hardship — which a lot of the US is in right now, and a lot of the world is experiencing right now — I think we’re gonna continue to see these stories where normal people who don’t see themselves as spies or as traitors to the United States, or as sympathetic to the North Korean regime or whatever, are gonna get in these situations. Now, this sounds like a farm, which is a little different.

DR’s Rob Wright: A little different.

DR’s Alex Culafi: But as we’re on this topic, I just I think this story — whether it’s a farm or it’s a person who didn’t realize what they were doing at first and then found themselves too deep in — I think we’re going to see this for a while, no?

DR’s Rob Wright: Yeah, yeah. No, I think we’re going to see more operations like this. So first of all, I had a tough time intro-ing this one because the operation is called “Operation Lonestar Roundup.” And every time I hear Lonestar I — and this is my crosse to bear — but I think of Spaceballs and I just start cracking up.

DR’s Alex Culafi: [laughs] OK.

DR’s Rob Wright: That aside, no, the data here is interesting. One hundred and eighty-seven devices seized. I think there were 14 people who were charged. I think there were a few arrests. But to your point, I think this is like a gig economy thing. I mean, we’ve had laptop farms for other stuff — click fraud, malvertising, stuff like that — for a long time. And I think we’re just gonna start to see more schemes like this take advantage of existing laptop farms and people that, to your point, may not totally know what they’re doing or who’s using them. So we’ll see.

DR’s Alex Culafi: Yep. And the thing I’ll also add is thinking about where things were with this North Korean IT worker fraud back a couple years ago. I know it extends further back than that. When it was still new and popping off, a lot of researchers we were talking to were like, ‘No, this is real and this is a big problem.’

DR’s Rob Wright: Yes. Yep.

DR’s Alex Culafi: And I doubted them at the time because I thought it was just the new story to talk about to get press attention. And maybe it also was that. But no, totally. This is pervasive. Organizations at every level are dealing with North Korean operators trying to either get paychecks to send back to North Korea or to get data that they can use to exploit later and it’s — I don’t know if it’s getting uglier, but it remains very ugly a few years later.

DR’s Rob Wright: Yes, indeed. What’ve got next here?

DR’s Alex Culafi: We have an interesting story. Russian authorities arrested three suspected members of the hacking group Data Suckers, including a 19-year-old member. and this is following the breach of Russian pizza chain Dodo Pizza —

DR’s Rob Wright: Of course.

DR’s Alex Culafi: — which is a longstanding pizza chain in in Russia, that reportedly exposed massive amounts of customer data. A lot of that would have been Russian customers, obviously. The group has also claimed attacks against Tez Tour, which is a Russian travel company, and Ukrainian grocery giant ATB, which is very unusual. Because by all accounts, expert accounts, they don’t seem to be politically motivated in the same way that a lot of Russian operators are, either working on behalf of the Russian government or actively participating in the in the war on Ukraine.

But it’s doubly interesting because for as long as I can remember, one of the golden rules among Russian hackers was not to hack Russians, for multiple reasons. One, because the government can sometimes provide cover for you, I’ve heard, for the activities you’re doing externally. And two, Russian authorities, if they think you’re messing with their civilians, they are very, very harsh, historically.

DR’s Rob Wright: Yes.

DR’s Alex Culafi: So this is really interesting that it’s Russia arresting Russian hackers. What do you think of this?

DR’s Rob Wright: I also thought it was interesting. I’m a little confused, I admit. When I read the story, one of the alleged DataSuckers hackers is a 19-year-old named Dennis Fridman. That does not sound like a Russian surname to me. So I don’t know where he hails from, if he was just living there, or if he is a Russian citizen. The thing that, to your points, the thing that really stuck out to me beyond Russia making some arrests here was I immediately thought, we’re failing the kids these days. We’re failing them.

DR’s Alex Culafi: Mm-hmm.

DR’s Rob Wright: These guys, this is just another example of an organization, a hacking group with teenagers who are obviously skilled and can do stuff that are just out there. They’re like, ‘Let’s hack Dodo Pizza.” I mean, I don’t know. We gotta start recruiting these kids — the government, and preferably not the Russian government, but the US, Canada, Five Eyes, whatever. We need to get out there and start finding these guys on like game forums and whatnot. Because this is just this is getting out of control with the number of quote unquote kids who are doing this stuff.

This came up in the documentary Midnight in the War Room. There’s a segment all about this, about how hackers get into the cybercriminal lifestyle. And it’s all younger kids, you know, preteens, teenagers, that are big gamers and then they get into this stuff. And now, the next thing you know, they’re in a Russian gulag. Well, I don’t know that this guy’s going to a Russian gulag or any of them are, but you get the point.

DR’s Alex Culafi: Yeah. No, and your point is also valid. Maybe Russia does hire these kids. They say, ‘Hey, we’ll let you go, but also we own your career now.’

DR’s Rob Wright: I know, I know. Yeah.

DR’s Alex Culafi: And then, you know, maybe that’s an appealing deal for them. Maybe they treat them right, or maybe they do send them to a gulag. Who knows? But it is it is interesting. Russia on Russia hacking. Yep.

DR’s Rob Wright: Indeed, indeed. All right. Last up we have a story. I think this just happened this week. It is from 404 Media. There was a big breach at Staples. Apparently, a cybercrime ring out of China hacked into Staples’ support system and issued five million dollars, churning out gift cards. Gift cards are just shooting out, and five million worth of these gift cards. And I guess the 404 Media reporters found this in court records. Raises a lot of questions for me about why this was not, I guess this was not disclosed prior to this.

But gift cards, yeah. A big breach, a big breach of a customer support system. And we know from other attacks similar to this, when you get into a support system, you can do quite a bit of damage. You can obtain a lot of secrets. You can obtain a lot of sensitive data. This one really was a little surprising to me. So Alex, what’d you think of this?

DR’s Alex Culafi: Stinks, obviously. I hope that —

DR’s Rob Wright: [laughs]

DR’s Alex Culafi: No, I mean, it’s a tough one, right? Because you hope that they can track these gift card serial numbers and invalidate them.

DR’s Rob Wright: Exactly, yeah.

DR’s Alex Culafi: Or that insurance takes care of it. And this is a little off track, but I kind of have a soft spot for modern Staples as like one of these little companies that are a place where you can get passports, where you can get the international clearance to travel. They have great copy printing services and they seem like a company that should have shuttered a long time ago but is finding new ways to become relevant in the 21st century, the 2020s. So I hope they figure this out. Other than that, for the purposes of a cybersecurity audience, I don’t know what else to say other than it stinks. I don’t know.

DR’s Rob Wright: I know, I know. I mean, there’s a lot of details here that have not been cleared up about how the hackers got into — I think it was called Nexus — the internal sort of support system, how they were able to get into like applications or processes or systems to issue these gift cards. But 15,000 gift cards?

And you know what they use them for — scams and whatnot. And they use it to launder money. And I just think it’s one of these cases where I’m sure Staples, their cybersecurity posture is probably pretty good, but this is one area that maybe they didn’t shore up because they didn’t think it was going be targeted. And it’s like, every part of your infrastructure and your and your network and your environment is going to be targeted these days if you’re a big company. So, you know, it’s a painful lesson.

DR’s Alex Culafi: Y you know, that’s true. And especially as these AI-orchestrated attacks get more powerful, the idea that having one blind spot will hurt you. But I don’t know. This is tough, and it kind of stinks that maybe their posture is good elsewhere, but it just takes one weakness, one blind spot for something like this to happen.

DR’s Rob Wright: Exactly.

DR’s Alex Culafi: So I don’t know if there’s a lesson learned, but it is a bummer.

DR’s Rob Wright: Yeah. All right, well that’s it for this week, Alex. Thank you so much for joining me. I appreciate it.

DR’s Alex Culafi: Thanks, Rob.