Federal law enforcement authorities have searched more than 40 residential properties across Texas and seized 187 computers and remote-access devices tied to an illicit overseas employment scheme, prosecutors announced Tuesday. The network, known as a laptop farm, allegedly allowed operatives working for the North Korean government to infiltrate American corporations by posing as domestic remote workers.
Dubbed Operation Lone Star Roundup, the multi-agency sweep focused heavily on residences in North Texas, where agents recovered about 100 computers, according to the U.S. Attorney’s Office for the Northern District of Texas. The machines were linked to an operation aimed at generating illicit revenue for Pyongyang’s nuclear weapons and ballistic missile development, federal officials stated.
How the laptop farms operated
According to federal prosecutors and cybersecurity firm CrowdStrike, which assisted the FBI in the investigation, the scheme relied on stolen American identities to secure remote employment contracts in the United States. Posing as software engineers or website designers, the overseas operatives applied for positions at domestic businesses using fabricated email addresses, spoofed LinkedIn accounts and falsified credentials.
Because the workers were based in North Korea, they required local facilitators to maintain their physical computing equipment inside the U.S., investigators said. Companies shipped corporate laptops directly to domestic addresses, where facilitators plugged them in and installed specialized hardware and software. Federal agents seized multiple keyboard-video-mouse switches, known as KVM devices, which allow operators abroad to manage multiple computers remotely while masking their actual location through proxies and virtual private networks.
CrowdStrike, which monitors the threat network under the name Famous Chollima, revealed that more than 70 U.S. companies across sectors including healthcare, defense engineering, aerospace, energy, financial services and cybersecurity were infiltrated. The Justice Department estimated that the fraudulent workers sent between 85 percent and 90 percent of their wages directly to the regime, with the U.S. Department of the Treasury estimating that North Korea earned more than $800 million through similar schemes in fiscal year 2024 alone.
Arrests and conflicting reports
The scope of arrests tied to the crackdown remains subject to differing accounts from authorities and private partners. CrowdStrike reported that two individuals were arrested in Ohio in connection with the broader nationwide network, and TechCrunch reported that prosecutors confirmed at least two arrests and indictments. However, local federal prosecutors in Dallas stated during a Tuesday news conference that no arrests had been made yet in the North Texas raids, though formal indictments against local facilitators are expected soon.
U.S. Attorney Ryan Raybould warned Americans against hosting hardware for overseas employers, dismissing claims of ignorance. Raybould stated that maintaining dozens of corporate laptops in a personal residence clearly indicates illicit conduct, warning that facilitators face federal criminal prosecution.
The FBIDallas field office noted that North Texas has become an attractive hub for such activity because of its large corporate footprint. Officials urged private businesses to strengthen their verification processes by utilizing E-Verify and demanding multiple forms of identification during hiring.
What happens next
CrowdStrike noted that while the Texas seizures disrupted local operations, the enforcement action is unlikely to permanently end North Korea’s global employment fraud, as operatives frequently adapt their routing techniques. The Justice Department confirmed that federal grand jury investigations and technical tracking of remaining infrastructure remain ongoing.
