The FBI seized about 187 devices from more than 40 Texas residences in a crackdown on fraudulent remote IT employment schemes.
DALLAS, TX — Federal agents searched more than 40 Texas residences and seized about 187 laptops and related devices in an operation targeting suspected “laptop farms” used by North Korean information technology workers to obtain remote jobs at U.S. companies, federal officials announced Tuesday.
The Justice Department said Operation Lonestar Roundup was carried out by the FBI from Sept. 21 through Sept. 25 as part of a broader effort to disrupt schemes tied to the Democratic People’s Republic of Korea. Authorities said roughly 100 devices were seized in North Texas. Investigators allege overseas IT workers used stolen or fabricated American identities and U.S.-based computers to make employers believe they were legitimate workers operating inside the country.
U.S. Attorney Ryan Raybould for the Northern District of Texas and FBI Dallas Special Agent in Charge R. Joseph Rothrock announced the operation Oct. 13. The Justice Department said North Korean workers and their facilitators used employer-issued laptops, virtual private networks, proxy infrastructure and remote-access technology to conceal where the workers were actually located. Officials allege wages earned through the jobs were transferred to accounts controlled by North Korea and helped generate revenue for sanctioned government programs.
The residences targeted in Texas were known or suspected laptop farms, according to the Justice Department. Under the alleged arrangement, U.S.-based facilitators received computers shipped by employers, kept the machines connected at American addresses and configured them so workers overseas could control them remotely. Authorities also seized KVM devices, which can allow a user to control computers through keyboard, video and mouse connections.
The Texas searches were announced as part of a wider Justice Department action against North Korean remote IT worker schemes. In a related case handled in Ohio, federal prosecutors announced charges against 14 people and the arrests of two U.S. nationals. Prosecutors allege that scheme affected more than 70 U.S. employers and generated about $3 million for IT workers. The companies were in industries including health care, communications, cybersecurity support, retail and manufacturing.
Federal officials have not said that the arrests in the Ohio case resulted directly from the North Texas searches. Authorities also had not announced arrests stemming specifically from Operation Lonestar Roundup as of Tuesday. CBS Texas reported that Raybould said indictments involving people who knowingly hosted laptop farms were expected. Any people charged would be presumed innocent unless proved guilty in court.
The FBI says North Korean IT workers have increasingly relied on people inside the United States to help conceal their identities and locations. In a public service announcement issued Tuesday, the bureau said facilitators may be paid to keep company computers connected to the internet, take part in job interviews or meetings, provide access to online accounts or complete other tasks designed to make fraudulent applicants appear legitimate. The FBI said some facilitators may knowingly participate while others may not initially understand whom they are assisting.
The bureau said the remote-worker operations have also evolved as companies and law enforcement agencies improve their detection methods. Rather than concentrating many computers at a few addresses, North Korean workers have increasingly used a larger number of laptop farms containing fewer devices, the FBI said. Investigators say stolen personal information and false professional profiles can also be used to get through hiring and identity-verification procedures.
Federal authorities say the schemes present both financial and cybersecurity risks because fraudulent employees can gain access to company networks, proprietary information and sensitive personal data. The Justice Department has pursued similar laptop-farm cases around the country in recent years, including previous operations that resulted in searches, computer seizures, criminal charges and prison sentences for people accused or convicted of helping North Korean workers obtain U.S. employment.
Authorities said the group of North Korean IT workers and facilitators involved in the Texas investigation has been identified by cybersecurity company CrowdStrike as “Famous Chollima.” The Justice Department said investigators also found evidence that fraudulent online accounts were used to support the alleged operation. Officials have not publicly identified all of the Texas residences searched or all of the employers whose computers may have been involved.
The North Texas investigation remains open, and federal officials said additional details will be released as appropriate. The Justice Department and FBI are continuing broader investigations into people and networks suspected of helping North Korean IT workers obtain remote employment and move the resulting income outside the United States.
Author note: Last updated October 13, 2026.