North Korean IT Workers’ Laptop Farms: 40+ Texas Homes Raided, 14 Charged

North Korean IT workers used laptop farms in more than 40 Texas homes to pose as American remote employees, the U.S. Justice Department said on Oct. 13, announcing that 14 people have been charged in a scheme that reached more than 70 U.S. companies. FBI agents searched or took action at those residences between Sept. 21 and Sept. 25 and seized about 187 laptops and KVM devices, according to the department. Two U.S. nationals have been arrested. The other named defendants are in China.

North Korean IT workers and laptop farms: what DOJ announced

The Texas sweep, which the FBI called Operation Lonestar Roundup, is one half of the announcement. The other is an indictment unsealed in the Northern District of Ohio. Prosecutors say the scheme ran from 2019 until about July 2025 and placed workers at employers in health care, communications, cyber support, retail and manufacturing, in Ohio, 16 other states and the District of Columbia. The department puts the scheme’s revenue at about US$3 million, money it believes went to sanctioned North Korean entities.

TechCrunch described the 40-plus homes as the largest disclosed number of residences used as laptop farms. The Justice Department did not name the companies.

The FBI’s own count of what agents carted out was “nearly 190 devices.” The department’s written figure is approximately 187, and that is the one we use.

Who was charged in the Ohio case

The two Americans arrested are Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. They face charges including wire fraud, money laundering and identity theft, per the release. Ten China-based defendants are named in the indictment: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long. Two more remain under seal. An indictment is an accusation; none of the 14 has been convicted.

U.S. Attorney David M. Toepfer of the Northern District of Ohio framed the case as a warning to HR departments: “These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

How a North Korean laptop farm works

The mechanics are almost mundane. A worker overseas lands a remote job using a stolen or fabricated American identity, alias email and social accounts, and a VPN or proxy that makes the connection look domestic. The employer ships a company laptop to a U.S. address. At that address, a paid facilitator plugs it in, installs remote-access software and keeps it running, then moves the paychecks on toward accounts North Korea controls. The KVM devices in the seizure count are the hardware that lets one person run several machines remotely.

“Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on,” said Ryan Raybould, U.S. Attorney for the Northern District of Texas.

The newer twist is labour. The department says “North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections,” and that they now hire facilitators for a wider range of tasks, sometimes subcontracting entire jobs to third-party foreign nationals. In other words, the person doing the work may not even be the person who was hired, and the person who was hired may not be who they claimed. CrowdStrike, which helped the FBI and tracks the group as Famous Chollima, told TechCrunch that laptop farms are “vital” to the operation.

Red flags for employers hiring remote workers

The department’s release points employers to a new FBI advisory published Oct. 13 for detection guidance, and it lists 11 Gmail addresses tied to the scheme that companies should add to their fraud-indicator lists. Our read of what the case implies for hiring teams:

• Ship hardware only to a verified address that matches the identity documents you checked, and treat a last-minute “send it to my cousin’s place” with suspicion.
• Audit company laptops for remote-access tools you didn’t install, and for signs of KVM-over-IP hardware.
• Watch payroll changes. Frequent bank-account switches are a classic tell.
• Re-verify after hiring. Subcontracting means a clean interview proves less than it used to; a live, on-camera check months in is cheap insurance.

Stolen identities are the raw material here, which is why it’s worth knowing what to do when your Social Security number leaks. And the same deception toolkit shows up in AI voice-clone scams, so families and HR teams face a version of the same problem.

What it means for Americans who host laptops

If a stranger offers to pay you to keep a few work laptops plugged in at home, this case is the answer to whether that’s legal. The two people arrested are Americans whose alleged role was hosting and running the machines. FBI Cyber Division Assistant Director Brett Leatherman said “close coordination between the private sector and federal law enforcement was central to this operation,” which means the employers who shipped those laptops are now watching for them.

The State Department, meanwhile, is offering rewards of up to US$5 million through Rewards for Justice for information on North Korean illicit finance. For more on federal cyber enforcement, see our report on the FBI’s Flax Typhoon action and the rest of our policy coverage.

In Texas, the FBI’s tally from five days of searches was more than 40 homes and roughly 187 machines, each one a desk in a job someone else was doing.