DOJ (Oct 13) announced coordinated actions against North Korean remote IT-worker schemes: a Northern District of Ohio indictment charging 14 people (two U.S. facilitators arrested, Michael James Bostelle and Juan Cecilio Pena Carrillo) over a scheme hitting 70+ U.S. employers for about $3M, plus "Operation Lonestar Roundup": FBI searches of 40+ suspected Texas laptop farms (Sept 21-25) and seizure of about 187 laptops and KVM devices. DOJ published scheme-linked email indicators, the FBI issued a new PSA, and CrowdStrike (which tracks the group as FAMOUS CHOLLIMA) described its assistance. Defender takeaway: identity proofing for remote hires, geolocation/device anomalies on corporate endpoints, and vendor/contractor access reviews remain high priority.