The Justice Department announced major action on Tuesday against North Korean IT worker schemes.
Federal authorities arrested two people and searched several “laptop farms” in Texas as part of “Operation Lonestar Roundup.” They seized about 187 computers used by IT workers associated with the North Korean regime.
Assistant Attorney General for National Security John A. Eisenberg noted that the regime “uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies.”
The Department of Justice explained the matter further in a press release.
According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.
In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.
The FBI Cleveland Field Office is investigating the case. Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the National Security Division’s National Security Cyber Section are prosecuting the case.
Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime’s sanctioned weapons programs. U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima.”
🚨 U.S. authorities dismantled over 40 laptop farms and charged 14 people in a North Korean IT worker fraud case. The scheme affected 70+ U.S. companies and generated about $3 million. Employer laptops were hosted in U.S. homes to disguise overseas workers. Read: https://t.co/4wqCCBWn4o
— The Hacker News (@TheHackersNews) October 14, 2026
North Korean laptop farmers operate as state-directed IT workers who use stolen or faked American identities to obtain remote technology jobs at U.S. companies. They work from overseas while concealing their true locations.
The fake workers use virtual private networks and proxy infrastructure to appear to operate in the United States. They rely on Americans to help facilitate the ruse by delivering company-issued laptops to residential addresses.
The U.S.-based facilitators also help transfer earnings to accounts controlled by North Korean entities that the U.S. has sanctioned.
The North Korean regime receives about 85 to 90 percent of the revenue from these scams and uses it to fund its nuclear and ballistic missile programs.
