“Each seized laptop represents a company that hired North Korean IT personnel,” Joseph Rothrock, Special Agent in Charge of the FBI Dallas Field Office, said after agents removed laptops and other equipment from Texas homes.
The seizures exposed the distribution system behind a longer-running North Korean effort to enter American corporate networks through remote work. Beginning in 2019, operatives linked to a group CrowdStrike calls Famous Chollima obtained technology jobs under stolen or forged US identities, using virtual private networks, or VPNs, to appear to be working inside the United States.
They found work in healthcare, communications, cybersecurity support, retail and manufacturing. The operation went on until around July 2025 and infiltrated more than 70 American companies, with employers in Ohio, 16 other states and Washington, DC.
The workers' access depended on people in the United States. Accomplices accepted laptops sent by the victimised companies at their homes, installed remote-access software and created what investigators call “laptop farms”, allowing the North Korean workers to retain access to corporate systems.
Those accomplices also received the workers' salaries and remitted the money to accounts controlled by the North Korean regime. Authorities believe approximately $3 million generated by the operation was channelled to the sanctioned regime.
The FBI and the US Attorney's Office for the Northern District of Texas announced on 13 October 2026 that they had dismantled the network through a joint operation called “Operation Lone Star Roundup.” The United States charged 14 people and arrested two in the alleged operation. The charges include conspiracy to commit wire fraud, money laundering, conspiracy to commit identity theft and aggravated identity theft.
The action followed work in late September 2026 by CrowdStrike's Counter Adversary Operations team and the FBI to identify and disrupt several laptop farms across the United States. Between 21 and 25 September 2026, the FBI searched more than 40 Texas residences under an initiative called Operation Lonestar Roundup.
Agents seized 187 items, including laptops, keyboards, video equipment and mice. CrowdStrike said the late-September disruption marked the start of a broader US law-enforcement effort to dismantle the group's US infrastructure.
Federal Prosecutor Ryan Raybold said: “It is absurd to have dozens of laptops sitting in your living room and claim to the government that you 'didn't know what was going on.'”
The laptop farms could also expand their holdings. CrowdStrike OverWatch observed operatives submitting fraudulent police reports saying a laptop had been stolen, a claim that triggered a replacement shipment to a farm address.
An earlier case showed the legal consequences for US-based participants. A woman from Arizona received a prison sentence of 8 years and 6 months after being found guilty of aiding North Korea through a laptop farm uncovered in 2023.
The funds traced in this case are smaller than the wider estimates associated with the method. Treasury Department estimates cited by Texas local broadcaster FOX 4 put revenue earned by North Korean IT workers this way at approximately 800 million dollars in 2024 alone.
Comments (0)