The FBI confiscated nearly 190 laptops in Texas during a crackdown on a North Korean operation that deployed fake remote workers to breach U.S. corporate networks. Agents executed raids on over 40 homes, targeting what they called “laptop farms” where foreign operatives accessed company systems using stolen identities. These workers’ earnings reportedly financed Pyongyang’s weapons programs. The operation, named Lonestar Roundup and announced on Tuesday, targeted a network allowing North Korean laborers to operate employer-provided devices remotely. Facilitators in Texas set up the computers and transferred wages directly into accounts controlled by the regime.
This effort builds on a broader campaign identified by CrowdStrike, which assisted the FBI in uncovering the scheme’s impact on more than 70 U.S. companies across aerospace, energy, and defense sectors. The firm tracks the network under the name Famous Chollima. Investigators found operatives used multiple tactics to divert corporate equipment, including filing false police reports claiming laptops had been stolen. Others manipulated staffing agencies or altered addresses to redirect devices before installing remote-access software. In some cases, facilitators altered the hardware’s appearance to avoid detection by corporate security teams.
This is not the first exposure of such operations. Last June, federal authorities searched 29 laptop farms across 16 states, including one case where a North Korean worker allegedly stole export-controlled technical data from a California defense contractor. Earlier this year, an indictment revealed attempts to secure contractor roles at U.S. agencies like Immigration and Customs Enforcement, though fingerprinting requirements blocked some applicants.
The latest seizures disrupt a major portion of the network, though CrowdStrike warned operatives will likely adjust their methods. Past disruptions slowed activity only in targeted regions, indicating the regime’s operations may continue with revised approaches. The Justice Department confirmed the investigation remains active, though no details on arrests or charges were released.
Federal officials have described these operations as part of North Korea’s ongoing effort to weaken U.S. economic and defense interests. The 187 seized devices in Texas included not only laptops but also keyboard-video-mouse setups used for remote control. About 100 of those devices were recovered in North Texas, according to prosecutors.
The FBI’s action aligns with past federal responses to North Korean cyber-enabled financial crimes. In May 2024, an indictment exposed attempts to infiltrate federal contractor pipelines, though security measures like fingerprinting requirements stopped some applicants. Another participant briefly worked at the General Services Administration before being terminated after an introductory meeting.
