FBI Seizes Nearly 187 Laptops in Operation Targeting North Korean IT Worker Scheme
Summary
The FBI searched 40 Texas residences and seized nearly 187 laptops in an operation targeting North Korean remote IT worker schemes. Two U.S. nationals were arrested, and 14 people were charged in related cases.
Key points
- In the Texas operation, codenamed Lonestar Roundup, the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.
- Agents seized approximately 187 laptops and KVM devices allegedly used by Famous Chollima operatives.
- The scheme used facilitators to host employer-issued computers, enabling North Korean IT workers to appear to be based in the United States.
- CrowdStrike described tactics for diverting company laptops to farms, including fake theft reports, address changes, and shipment redirection.
- Two U.S. nationals were arrested on wire fraud, money laundering, and identity theft charges; the DoJ also announced charges against 12 Chinese defendants.
- An Ohio indictment describes a scheme that allegedly affected 70 U.S. companies from 2019 to July 2025 and generated roughly $3 million.
Article Details
- Event Type
- U.S. law enforcement operation targeting North Korean IT-worker schemes, including laptop farms allegedly used by Famous Chollima operatives; two U.S. nationals were arrested, 14 individuals were charged, and approximately 187 laptops were seized.
- Impact
- The operation disrupted laptop-farm infrastructure used to make North Korean remote IT workers appear U.S.-based. A separate Ohio case described a scheme that affected 70 companies and generated roughly $3 million for North Korean threat actors. The article says CrowdStrike expects the Texas operation to have limited impact and describes it as the beginning of a broader U.S. law enforcement effort.
People
Threat Actors
Vendors
Countries
North KoreaBecause North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using stolen, rented, or fabricated identities.United StatesLaptop farms are locations where facilitators host employer-issued computers that North Korean IT workers access remotely to appear based in the United States.