FBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies

The FBI searched more than 40 Texas residences and seized 187 laptops and other devices used to help North Korean operatives obtain remote jobs at U.S. companies under false identities, federal prosecutors announced Tuesday.

The effort, dubbed Operation Lonestar Roundup, targeted “laptop farms” that housed employer-issued computers and allowed workers overseas to access them remotely. U.S.-based facilitators configured the devices and transferred earnings to North Korean-controlled accounts, according to the Justice Department.

CrowdStrike, which provided intelligence and technical analysis to support the FBI’s work, said the broader operation affected a campaign targeting more than 70 U.S. companies and included two arrests in Ohio. The company did not identify those arrested or describe the charges in its announcement to reporters. The Justice Department’s Texas release did not address the Ohio arrests.

The scheme gave North Korean workers access to corporate systems while generating revenue for the regime’s sanctioned weapons programs, authorities said. By routing their work through computers physically located in the United States, operatives could conceal that they were working abroad.

“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said in a statement.

The 187 devices seized in Texas included laptops and keyboard-video-mouse equipment, which can be used to control computers remotely. About 100 devices were recovered in North Texas, according to prosecutors.

CrowdStrike tracks the network under the moniker Famous Chollima and said its work with the FBI disrupted several U.S. laptop farms in late September. Organizations identified in the disrupted operations included businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering and government technology, the company said.

CrowdStrike described several ways operatives diverted employer-issued computers to the farms. Some filed false police reports claiming their laptops had been stolen so employers would ship replacements to different addresses. Others claimed last-minute moves or obtained jobs through staffing firms, allowing equipment to be redirected without those firms’ knowledge.

Once the computers arrived, facilitators installed hardware and software that enabled overseas workers to operate them, according to CrowdStrike. The company said operatives also disguised equipment used in the scheme to make it harder for security teams to detect.

The action adds to a series of federal investigations into North Korea’s use of fraudulent IT employment to raise money and gain access to sensitive information.

Last June, DOJ announced actions involving searches of 29 known or suspected laptop farms across 16 states. In one case, prosecutors alleged that an overseas worker accessed and stole export-controlled technical information from a California defense contractor developing artificial intelligence-powered equipment. A senior FBI official said at the time that at least one U.S. government contractor had been caught up in the fraudulent hiring schemes.

The schemes have reached direct federal hiring pipelines. In a case disclosed in May 2024, participants tried to obtain contractor positions at Immigration and Customs Enforcement and the Federal Protective Service but could not meet fingerprinting requirements, according to an indictment. Another participant secured a contractor position at the General Services Administration but was terminated five days after an introductory meeting.

The latest seizures are unlikely to end broader DPRK operations. CrowdStrike said the disruptions would probably slow activity primarily in the areas where farms were shut down and were unlikely to have lasting effects, as operatives adapt their techniques to avoid detection.

The Justice Department said the investigation remains ongoing.