DALLAS, TX – October 14, 2026 (STL.News) Federal authorities have dismantled a major network of suspected North Korean laptop farms operating across Texas, seizing approximately 187 computers and remote-access devices in an operation targeting an elaborate scheme to infiltrate American companies, steal identities, and generate revenue for North Korea‘s sanctioned weapons programs.
The FBI and U.S. Department of Justice announced the results of Operation Lonestar Roundup on Tuesday, October 13, revealing that federal agents searched more than 40 Texas residences during a coordinated enforcement operation conducted September 21–25.
Approximately 100 electronic devices were seized in North Texas, including the Dallas-Fort Worth region, where investigators uncovered equipment allegedly used to conceal the locations of North Korean information technology workers employed by American businesses.
The operation is part of a broader federal investigation into North Korean operatives who allegedly obtained remote technology jobs using stolen or fabricated American identities. In related proceedings announced in Ohio, federal prosecutors disclosed charges against 14 defendants in a conspiracy that affected more than 70 U.S. companies and generated approximately $3 million in employment revenue.
Federal officials believe proceeds from these employment schemes have been transferred to entities controlled by North Korea, potentially supporting the country’s nuclear weapons and ballistic missile development programs.
FBI Searches More Than 40 Texas Residences
Operation Lonestar Roundup represents a significant federal enforcement action against the infrastructure supporting North Korea’s covert employment operations in the United States.
According to the U.S. Attorney’s Office for the Northern District of Texas, federal investigators identified residences where individuals not physically present in the United States remotely operated company-issued computers.
These locations, commonly called laptop farms, allowed overseas workers to maintain the appearance of legitimate American employment.
The FBI seized laptops and keyboard-video-mouse devices, commonly called KVM equipment, that let someone operate a computer from another location.
Investigators allege that American facilitators received laptops shipped by legitimate employers, configured the equipment for remote access, and maintained the devices while North Korean workers performed their jobs from overseas.
The arrangement could make an overseas worker appear to be operating from a residential address in Texas, even when the person accessing the company’s computer was thousands of miles away.
Federal officials said the operation disrupted an important part of the infrastructure used to deceive American employers.
U.S. Attorney Ryan Raybould, who leads the Northern District of Texas, described the investigation as an effort to combat a foreign-backed scheme involving stolen American identities, unauthorized access to corporate systems and the diversion of American wages.
FBI Dallas Special Agent in Charge R. Joseph Rothrock joined Raybould in announcing the enforcement action.
The Texas investigation remains ongoing, and authorities have encouraged companies and individuals with relevant information to contact the FBI.
How North Korean Laptop Farms Operated
The alleged scheme exploited American businesses’ growing dependence on remote technology workers.
According to federal investigators, North Korean operatives submitted employment applications using identities that concealed their actual citizenship, location, and connections to the North Korean government.
Some applications allegedly relied on stolen American identities, while others used fabricated documentation and technical methods intended to disguise the applicants’ locations.
After securing employment, the workers arranged for facilitators to deliver their employer-issued computers to American addresses they controlled.
Those facilitators established the laptop farms, allowing overseas operators to access the computers through remote-access technology.
The system created several advantages for the alleged conspirators.
First, it allowed workers to appear to be located in the United States, potentially avoiding geographic restrictions employers imposed.
Second, it provided access to corporate computer systems through devices issued and managed by legitimate American companies.
Third, it enabled the collection of salaries from employers who believed they had hired qualified workers operating under legitimate identities.
Finally, the arrangement created a mechanism for transferring employment earnings to individuals or organizations connected to North Korea.
The Justice Department said investigators identified the activity as part of a broader North Korean effort to generate foreign currency through fraudulent employment.
Cybersecurity company CrowdStrike has identified the associated threat network as Famous Chollima.
Federal Indictment Charges 14 Defendants
The Texas raids were announced alongside a related federal criminal case in the Northern District of Ohio.
Federal prosecutors said a grand jury returned a 58-page indictment on October 1, 2026, charging 14 individuals with conspiracy to commit fraudulent remote employment.
The charges include conspiracy to commit wire fraud, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft.
The indictment alleges that the conspirators helped North Korean technology workers obtain employment with American companies through false identities and concealed overseas operations.
Two defendants were arrested in connection with the Ohio investigation, while authorities identified others as operating from China.
Authorities said the employment conspiracy affected more than 70 American businesses and generated approximately $3 million in revenue for the workers.
The affected businesses operated in several industries, including health care, communications, cybersecurity support, retail and manufacturing.
Federal prosecutors identified victim companies across numerous states, including Texas, Illinois, Missouri’s neighboring states, California, New York, Florida and Pennsylvania.
The Ohio criminal case and Texas enforcement operation are parts of the Justice Department’s coordinated crackdown, but the indictment should not be interpreted as establishing that one of the charged defendants operated every Texas location searched.
The indictment’s allegations have not been proven in court. All defendants are presumed innocent unless and until proven guilty.
Why North Korea Targets American Technology Jobs
Federal authorities say North Korea has developed an extensive system for placing technology workers with foreign employers to generate revenue for its government.
The country faces extensive American and international sanctions designed to restrict financial resources available for prohibited weapons development and other sanctioned activities.
However, remote employment offers an opportunity to obtain foreign currency without requiring workers to travel physically to the countries where their employers operate.
For example, an individual posing as an American software developer could receive a substantial salary from a legitimate company while secretly operating under the direction of overseas handlers.
When repeated across numerous employers and workers, the revenue can become significant.
Federal authorities have previously warned that individual North Korean IT workers may earn as much as $300,000 annually through overseas employment arrangements.
The threat extends beyond lost wages.
Workers who obtain legitimate employee credentials may gain access to sensitive company information, internal communications, proprietary software, and other valuable business systems.
Depending on their job responsibilities and assigned permissions, they could potentially access confidential customer information, financial records, or intellectual property.
Not every fraudulent employment case involves confirmed theft of sensitive corporate data. Nevertheless, federal authorities have documented broader North Korean employment schemes involving data theft and extortion.
The combination of financial fraud and potential corporate espionage makes these operations particularly concerning to federal national security officials.
American Companies Face Growing Cybersecurity Risks
The Texas enforcement operation highlights weaknesses in remote hiring and employee identity verification.
Companies frequently recruit software engineers, network administrators, cybersecurity specialists, and technical support personnel through online applications and video interviews.
Many positions allow employees to work remotely without regularly visiting a corporate office.
Although remote employment provides legitimate advantages for businesses and workers, federal investigators say North Korean operatives have exploited weaknesses in hiring procedures to conceal their identities.
A company may verify that a computer is using an American internet connection without confirming the employee is physically present at that location.
Similarly, a worker who completes a technical interview may still use false identity documents or conceal a connection to a sanctioned foreign government.
Laptop farms add another layer of deception because the employer’s computer remains physically inside the United States.
Security systems that rely heavily on device location may therefore fail to identify the overseas operator.
The scheme shows that conventional cybersecurity protections are not always sufficient when an individual receives authorized access through fraud.
Employers must consider identity verification, payroll arrangements, equipment delivery, remote-access controls, and unusual employee behavior as interconnected security issues.
What Employers Can Do to Protect Their Networks
The FBI and Justice Department have repeatedly urged American businesses to strengthen hiring and cybersecurity procedures in response to North Korean remote employment schemes.
Businesses should verify remote applicants’ identities through reliable documentation and appropriate employment eligibility procedures.
Employers should also investigate inconsistencies between an applicant’s stated location, identity information, employment history, and technical connection details.
Companies shipping laptops to remote employees should confirm delivery addresses and maintain accurate records of equipment assignments.
Unexpected requests to redirect equipment to unfamiliar residential addresses may warrant additional verification.
Security teams should examine unauthorized remote-access tools, unusual network connections, and suspicious patterns involving corporate devices.
Employers can also limit potential damage by restricting employee access to the information and systems needed for their assigned responsibilities.
Employers should apply these precautions consistently and lawfully to remote workers, rather than relying on nationality or ethnicity as indicators of suspicious activity.
The FBI encourages businesses that suspect involvement in a North Korean employment scheme to report the activity through the Internet Crime Complaint Center at IC3.gov.
Federal Crackdown Extends Beyond Texas
Operation Lonestar Roundup is not the first federal action targeting North Korean remote employment networks.
The Justice Department has pursued similar cases involving American facilitators, fraudulent employment applications, laptop farms, and financial transfers connected to North Korea.
In June 2025, federal authorities announced coordinated searches of 21 locations across 14 states, seizing approximately 137 laptops connected to suspected North Korean employment operations.
The federal government’s ongoing enforcement effort is called the DPRK RevGen: Domestic Enabler Initiative.
The initiative focuses on disrupting the American-based individuals and infrastructure that let North Korean operatives get jobs, receive corporate equipment, and collect salaries.
Previous investigations have resulted in criminal convictions, prison sentences, financial seizures, and the disruption of networks operating across multiple states.
The October 2026 Texas operation demonstrates that authorities continue to identify new laptop farms despite earlier enforcement actions.
Investigation Continues After Dallas-Area Raids
Federal officials have not announced that they have eliminated the entire North Korean remote employment network.
Instead, the seizure of about 187 devices disrupts identified infrastructure used in suspected fraudulent employment operations.
Investigators may examine the recovered equipment to determine which employers were affected, who controlled the devices, how corporate systems were accessed, and where employment payments were transferred.
The investigation also raises broader questions about the effectiveness of remote employee verification across American industries.
For businesses, the case illustrates how an ordinary employment relationship can become a national security concern when a foreign operative obtains access to corporate systems through deception.
For federal authorities, the Dallas-area raids are another step in an ongoing effort to interrupt the financial networks that help North Korea obtain foreign currency despite international sanctions.
The Justice Department and FBI say the investigation remains active, with additional developments possible as investigators examine the seized devices and pursue those allegedly responsible.
