The U.S. Department of Justice has charged 14 people and seized roughly 187 laptops and KVM devices in a crackdown on North Korea’s fraudulent remote IT worker scheme. Between September 21 and 25, the FBI searched about 40 residences in Texas suspected of hosting “laptop farms” in an operation called Lonestar Roundup. A laptop farm is a home where a U.S. facilitator keeps company-issued computers connected so that overseas workers can log in remotely and appear to be based in the United States.
An Ohio indictment describes a scheme that ran from about 2019 to July 2025, affected more than 70 U.S. companies and generated roughly $3 million for North Korean operatives, using stolen or fabricated identities, VPNs and proxy infrastructure. Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested; the remaining defendants, mostly Chinese nationals, are at large. Victims spanned health care, communications, cyber support, retail and manufacturing. CrowdStrike, which tracked the Famous Chollima group (also called WageMole) behind the operation, says it expects the raids to have limited impact on their own and calls them the start of a wider effort. It describes operatives redirecting employer laptops to farm addresses by filing fake theft reports, rotating residential addresses and claiming last-minute relocations, and says that public exposure has pushed them toward spoofing or reusing device identifiers. This follows earlier coverage of the scheme, including researchers who baited operatives with a fake crypto startup and its spread into healthcare and sales.
How to check if you’re affected
Affected products are not software here; the exposure is in hiring and device shipping. The FBI’s October 13 advisory says no single indicator reliably identifies these workers and recommends an “identity in depth” approach across the employment lifecycle. Based on the reporting, employers can review:
- Remote hires whose laptops were shipped to an address different from their identity documents, or who reported a laptop stolen and asked for a replacement to be sent elsewhere.
- Multiple apparently unrelated employees whose devices connect from the same residential address, or whose device identifiers repeat across accounts.
- Remote-access software installed on company laptops that the employee did not need for the job.
Individuals should treat unsolicited offers to interview on someone’s behalf, receive and host laptops at home, or share personal account logins for payment as part of this scheme. The FBI says these actions are illegal and that operatives have used threats and extortion against Americans who help them.
Sources
- FBI PSA I-101326-PSA: North Korean IT Workers Expanding Use of Facilitators
- DOJ: 14 indicted in North Korean remote IT worker conspiracy affecting more than 70 U.S. companies
- CrowdStrike: FBI disrupts Famous Chollima operation
- FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested — BleepingComputer
- U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud — The Hacker News