The FBI has raided suspected North Korean laptop farms in Texas as part of a crackdown on fraudulent remote IT employment. Authorities searched 40 residences and seized approximately 187 laptops, alongside equipment used to access computers remotely.
The Justice Department also announced charges against 14 people in a related remote-worker conspiracy. Two U.S. nationals face allegations involving wire fraud, money laundering and identity theft.
Texas Searches Target Remote Access Infrastructure
The FBI carried out the Texas searches between September 21 and 25 under an operation called Lonestar Roundup.
Investigators targeted residences suspected of housing employer-issued laptops for North Korean workers. These locations allow overseas operatives to access company computers while appearing to work from within the United States.
Alongside the laptops, agents seized KVM devices, which provide keyboard, video and mouse access to connected computers.
Researchers linked the equipment to Famous Chollima, also known as WageMole. They had tracked the group’s activity since April 2025.
The group runs fraudulent IT employment operations that generate revenue for North Korea’s government, despite extensive international sanctions.
North Korean Laptop Farms Help Conceal Workers’ Locations
The schemes depend on a combination of false identities and local assistance.
North Korean operatives apply for technology jobs using stolen, rented or fabricated identities. Meanwhile, facilitators receive and host the computers that employers issue to their supposed U.S.-based recruits.
The overseas workers then connect remotely to those devices. This arrangement helps disguise their actual locations while they perform paid work.
However, the risks can extend beyond fraudulent employment. In some cases, operatives also attempt to steal sensitive information, introduce malware or obtain cryptocurrency and other assets.
Operatives Use False Claims to Redirect Company Laptops
Researchers identified several ways the workers diverted employer equipment to laptop farms.
For example, some submitted false theft reports so companies would ship replacement devices to a different address. Others claimed they had moved shortly before delivery.
Additionally, operatives rotated through residential addresses to obscure the computers’ final destinations.
Some also exploited IT staffing positions they held to redirect shipments without attracting attention. Together, these methods helped separate delivery locations from addresses shown in their identity documents.
Researchers say growing public scrutiny has also pushed the operators toward spoofing device identifiers. In some instances, they reused identifiers across different victim organizations.
Ohio Indictment Describes Scheme Affecting 70 Companies
Separately, an Ohio indictment outlined an alleged remote IT worker operation that ran from 2019 through July 2025.
According to prosecutors, the scheme affected around 70 U.S. companies and generated roughly $3 million for North Korean operatives.
The workers allegedly combined stolen or fabricated identities with VPNs and proxy infrastructure to present themselves as U.S.-based employees.
Meanwhile, American facilitators allegedly hosted employer laptops, installed remote-access software and transferred earnings to accounts controlled by North Korea.
Authorities arrested U.S. nationals Michael James Bostelle and Juan Cecilio Pena Carrillo. They face charges involving wire fraud, money laundering and identity theft.
The Justice Department also announced charges against 12 Chinese defendants in connection with the alleged conspiracy.
Investigators Signal Further Action Against U.S. Infrastructure
The Texas raids removed equipment supporting the group’s access to U.S. employers. Nevertheless, researchers cautioned that a single operation would likely have a limited effect on the wider network.
They described Lonestar Roundup as an opening step in a broader law enforcement effort against Famous Chollima’s infrastructure inside the United States.
The announced searches and charges therefore represent a disruption of the alleged operations, rather than confirmation that the wider schemes have ended.
0 responses to “FBI Raids Texas Laptop Farms Linked to North Korean IT Worker Schemes”