The FBI searched more than 40 homes across Texas in September and seized 187 laptops and remote-control devices that prosecutors say kept North Korean laptop farms running. The searches, carried out between 21 and 25 September 2026, were announced on 13 October by the Justice Department. About 100 of the devices came from homes in North Texas. The bureau is now asking companies to check whether they employed one of the workers behind the scheme, and to report what they find.
How North Korean laptop farms worked
North Korean IT workers applied for remote jobs at United States companies using stolen or fabricated American identity documents, prosecutors said. They used virtual private networks and proxy networks to make it look as if they were working from inside the United States. When a company hired one of them, it mailed a laptop to an address in the United States.
That address was one of the North Korean laptop farms. An American facilitator kept the laptop running at home, installed remote-access software, and let the worker overseas log in and do the job. The pay went through accounts the facilitators controlled, and prosecutors said the money flowed back to the North Korean regime. The earnings help fund weapons programmes that are under sanctions, the Justice Department said.
The devices seized from the North Korean laptop farms included laptops and KVM units. A KVM unit lets one keyboard, video screen and mouse control a computer somewhere else. Each laptop seized could stand for one company that hired a North Korean IT worker, FBI Dallas Special Agent in Charge R. Joseph Rothrock said when the operation was announced.
Operation Lonestar Roundup in Texas
The sweep was called Operation Lonestar Roundup, and it targeted North Korean laptop farms across the state. United States Attorney Ryan Raybould, of the Northern District of Texas, announced it with Rothrock in Dallas. Raybould said every laptop farm the bureau shuts down cuts off a revenue stream the North Korean government relies on to fund weapons programmes. Rothrock said the bureau would not allow enemies of the United States to exploit its businesses or compromise national security.
CrowdStrike, the United States cybersecurity firm, worked with the FBI on the case. The firm calls the group behind the workers Famous Chollima. The Justice Department published 11 Gmail addresses it said the workers used to apply for jobs, so employers could check their own records. No one had been charged in the Texas case when the operation was announced, and the investigation remains open.
The Texas searches were part of a wider set of actions announced the same day. In a separate case, federal prosecutors in the Northern District of Ohio unsealed a four-count indictment charging 14 people with wire fraud, money laundering and identity theft. Two men were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Prosecutors said that group obtained remote jobs at more than 70 United States companies between 2019 and about July 2025 and collected roughly $3 million.
What North Korean laptop farms mean for employers
The scheme behind the North Korean laptop farms worked because the workers looked ordinary on paper. They hold a company laptop, join video calls, and submit work. The warning signs sit in the gaps: a laptop that never moves, a worker who will not meet in person, or a home address that hosts several company machines. The FBI has warned that no single sign reliably gives the scheme away.
A 2022 federal advisory cited by the department said a single North Korean IT worker can earn up to $300,000 a year. At that rate, a small group of hires can move large sums. The department said thousands of North Korean IT workers hold jobs at Western companies, a scale that makes the Texas seizures a dent in the trade rather than its end.
Companies that suspect they hired a worker through the North Korean laptop farms can file a report at ic3.gov, the FBI’s internet crime complaint centre. The bureau said any company or person with information on the North Korean laptop farms should come forward. Employers can also check the published Gmail addresses against their hiring records. The department has not named the firms affected.
How to report a suspected case
A firm should first match the published addresses against its own staff records. A company that finds a match in the North Korean laptop farms should preserve the laptop and its logs before it wipes or returns the machine. Those records show who logged in, from where, and what they touched.
The bureau said further details will follow as the investigation develops. The North Korean laptop farms sat in ordinary homes, and the firms that hired their workers may still not know.