Between 21 and 25 September 2026, FBI agents executed search warrants at more than 40 residential addresses across Texas. They were not looking for drugs or weapons. They were looking for laptops — company-issued machines, plugged in on desks and in spare rooms, each one logged into a US employer's network on behalf of someone thousands of miles away.
The operation was codenamed Lonestar Roundup. Agents seized approximately 187 laptops and KVM devices, around 100 of them in North Texas alone.
On 13–14 October, the Department of Justice unsealed the result: 14 people charged over a conspiracy that reached more than 70 US companies and generated roughly $3 million for the North Korean regime. Two arrests were made. The rest are overseas.
The most sobering line came from the FBI's Dallas field office, whose Special Agent in Charge noted that "Each laptop seized potentially represents one company that has hired a DPRK IT worker."
What happened
The raids and the charges
The indictment was unsealed in the Northern District of Ohio and charges a mix of US citizens and Chinese nationals with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft.
Of the 14 charged:
Ten are China-based, located in Dandong City, Liaoning and Shenzhen. All remain at large.
Two are US citizens — Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. Both have been arrested.
Two remain under seal.
A further US-based co-conspirator, Trey Michael Nolte, is named in the indictment but not charged. He is alleged to have run a shell company, Dark Falls LLC, which presented itself as a software development business while serving as a vehicle for the scheme.
The alleged conduct of the two arrested Americans illustrates how modest the individual roles were. Bostelle is said to have supplied his name and a fraudulent driver's licence to help a remote worker get hired. Carrillo is alleged to have hosted laptops at his home under various names, receiving around $190,000 from five employers.
The scheme ran from roughly 2019 until about July 2025.
Who the victims were
The DOJ described victim companies spanning health care, communications, cyber support, retail and manufacturing. They were located well beyond Ohio — across Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania, Washington and the District of Columbia.
In other words: this was not a regional problem with a Texas footprint. Texas was simply where the hardware lived.
Who is behind it
The operation is tracked by security vendors as Famous Chollima, and also as purpledelta and Wagemole. CrowdStrike, which assisted the investigation, has been tracking the operatives involved since April 2025.
The purpose is sanctions evasion and revenue generation. Court documents allege the scheme was intended to generate illicit income for the DPRK government in violation of international sanctions, funding its nuclear weapons and other military programmes.
How the scheme works
This is not a hacking story in the conventional sense. No malware was needed, no vulnerability exploited. The attack surface was the hiring process.
1. Get hired under a false identity
North Korean IT workers apply for remote roles using stolen or fabricated identities, supported by VPNs and proxy infrastructure to appear US-based. The FBI reports they also falsely claim ownership of social media accounts and professional profiles belonging to real people in the tech sector, lending applications a veneer of history and credibility.
2. Recruit an American to host the hardware
This is the step the whole scheme depends on. Employers ship a laptop to the address on file — so that address has to be real, domestic, and belong to someone willing to receive it.
Facilitators host the employer-issued machines at their homes, install remote-access software, and let the overseas worker operate the device as though sitting at that desk. CrowdStrike describes the arrangement bluntly: the laptop farm and its facilitators function as "a rented U.S. footprint" — a physical address, a legal identity, and a means of satisfying financial institutions' know-your-customer checks.
Facilitators are paid a fee. They also set up US bank and money-transfer accounts to move salaries overseas.
3. Get the laptop to the farm, not the stated address
CrowdStrike documented several techniques used to redirect hardware during onboarding:
Filing fraudulent police reports claiming a laptop was stolen, triggering a replacement shipment to a farm address
Rotating through residential addresses to obscure the final destination
Claiming last-minute relocations to divert devices mid-shipment
Going through IT staffing firms, so end-client devices could be redirected to farm infrastructure without the staffing firm knowing
4. Stay hidden
A KVM-over-IP device — keyboard, video, mouse — lets an operator control a physical computer from anywhere, with the machine itself never leaving its US address. From the employer's view, the laptop checks in from the right place.
Since at least May 2026, Famous Chollima has been observed spoofing device hashes, for instance making a video capture card present itself as a webcam, to conceal the use of these tools from endpoint monitoring.
5. Do the job — or subcontract it
One of the strangest findings in the FBI's accompanying alert: North Korean workers are increasingly hiring freelancers to do the actual work, typically in Pakistan, India, Nigeria or neighbouring countries, for a fraction of the salary. Freelancers are also hired to mass-apply for jobs and in some cases to sit interviews on the operatives' behalf.
What's new and more serious this time
The FBI's alert accompanying the takedown flags several escalations that go beyond the familiar playbook:
Threats of physical violence. The FBI identified cases where threat actors threatened former managers and their families to extort payments and coerce cooperation. This is new, and it moves the scheme from fraud toward something closer to organised crime.
Targeting of cleared and sensitive roles. Operatives are reported to be pursuing positions requiring US government security clearances, and targeting cleared defence contractors and companies holding government contracts.
Targeting active-duty military members to host laptops.
Exploiting economic vulnerability. The FBI says operatives deliberately approach economically vulnerable Americans with facilitator work, and in some cases use facilitators' identities without permission to apply for more jobs than agreed.
Elaborate cover stories. Common pretexts include claiming to be Chinese or East Asian nationals needing a temporary US presence, or Eastern Europeans displaced by the war in Ukraine.
Why it matters
The threat is an insider threat, and it arrives through HR. These were not intruders. They were onboarded, badged, paid and given legitimate credentials. Security tooling built to detect unauthorised access will not flag an authorised user doing authorised things.
The scale is the real story. $3 million across 70 companies over six years is not, by itself, a large fraud. But the FBI describes North Korean IT workers at Western companies numbering in the thousands, and characterises them as a significant national security and intellectual property theft insider threat. This indictment is one thread.
A worker with a salary also has access. Anyone employed as an IT contractor has credentials, repository access, and often production systems. Revenue may be the current objective; the positioning is the longer-term risk.
The disruption will not last. CrowdStrike's own assessment is notably unromantic: this is likely to slow operations only in the immediate areas where farms were shut down, and is unlikely to have lasting effect. The adversary will keep evolving to evade detection. Treat the takedown as useful intelligence, not as a problem solved.
Who is affected
Any company hiring remote technical staff, particularly through contractor or staffing arrangements. Victim industries here were ordinary: health care, retail, manufacturing, communications.
IT staffing and recruitment firms, which were used as an unwitting channel to redirect end-client hardware.
Defence contractors and government suppliers, now explicitly named as targets.
Americans approached with "host a laptop" side work. Two of the people charged are US citizens whose roles were small and whose exposure is now criminal. Anyone offered money to receive packages, forward equipment or lend their identity to an employment application should understand what they are being recruited into.
Freelancers in South Asia and West Africa, who may be doing subcontracted work, or sitting interviews, without knowing for whom.
What organisations should do
Hiring
Verify identity against the person, not the paperwork. Require live video with ID held up, and treat refusal or persistent camera problems as a signal, not an inconvenience.
Watch for the address mismatch. A request to ship equipment somewhere other than the address on the identity documents — especially framed as a last-minute relocation — is the single strongest indicator in this entire playbook.
Treat a "stolen laptop" replacement request as a verification event. A fraudulent police report is cheap. Confirm the shipping address independently before dispatching a replacement.
Check that the professional history belongs to the applicant. These operations reuse real people's LinkedIn profiles and GitHub histories. Contact references through channels you source yourself, not numbers supplied in the application.
Extend all of this to staffing partners. Ask explicitly how your suppliers verify identity and where they ship devices, and require notification of any mid-onboarding address change.
Devices and access
Inventory where your corporate laptops physically are. Multiple machines checking in from one residential address, or clusters of unrelated employees sharing a location, is the pattern that unravelled this network.
Look for KVM-over-IP and remote-access tooling on endpoints. Note that operatives have begun spoofing device hashes to disguise these as ordinary peripherals, so hardware-ID checks alone are no longer sufficient.
Apply least privilege and monitor for impossible travel between the endpoint's reported location and the user's network activity.
Payroll and finance
Flag payment redirection, especially to money-transfer services, and recently opened accounts that do not match the employee's stated location or history.
Reconcile the person, the device and the bank account. The mismatch usually exists in at least one of the three.
If you suspect you have one
Do not simply terminate. Preserve evidence, review what the account accessed, and contact law enforcement. The FBI has asked businesses to review hiring processes and report suspicious activity.
Assume the access mattered. Audit repositories, credentials and data the worker could reach, and rotate anything they touched.
Final thoughts / key lesson
Strip away the geopolitics and this is a story about a shipping address. The whole architecture — stolen identities, VPNs, shell companies, KVM switches, money mules — exists to solve one problem: a US employer will post a laptop to a US address, and someone has to be standing there to receive it.
The lesson: remote hiring is now a security control, and most organisations run it as an HR process. Identity verification, device shipping and payroll setup are the three checkpoints where this scheme must pass, and in most companies all three sit outside the security team's remit entirely.
The second lesson is about durability. Law enforcement seized 187 devices and charged 14 people, of whom ten are beyond reach in China. The analysts closest to the case expect the disruption to be geographically narrow and temporary. That is not a criticism of the operation — it is a realistic description of what enforcement can achieve against a state-run programme with thousands of participants.
So the practical question for any organisation hiring remote technical staff is not whether this network was dismantled. It is simpler and more uncomfortable: how many of your laptops are at addresses you have never verified?
