FBI Searched 40 Homes in 'Lonestar Roundup' Against North Korean IT Worker Laptop Farms, Seizing About 187 Devices

The U.S. Department of Justice has charged 14 people and the FBI has seized about 187 laptops and KVM devices in an operation against North Korean remote IT worker schemes. According to BleepingComputer, the Texas action, codenamed "Lonestar Roundup", involved searches of 40 residences suspected of hosting laptop farms between September 21 and 25. Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested.

What is known

• Group: the DoJ says it disrupted Famous Chollima (also tracked as WageMole), a cluster tied to DPRK revenue generation. CrowdStrike has tracked the activity since April 2025.
• Charges: wire fraud, money laundering and identity theft against the arrested U.S. nationals.
• Scale of the Ohio indictment: a scheme running from 2019 to July 2025 that affected 70 companies and produced roughly $3 million for DPRK actors.
• Related charges: the DoJ also announced similar charges against 12 Chinese defendants. The report does not make clear whether they overlap with the 14.
• Not published: the names of affected companies and of most of the 14 charged individuals.

How a laptop farm works

The scheme depends on an ordinary-looking U.S. presence. Operatives use stolen or fabricated identities to get hired as remote workers. U.S.-based facilitators then receive the company-issued laptop at their home, install remote-access software, and keep the device online so the worker appears to be logging in from inside the country. VPNs and proxy infrastructure cover the rest, and earnings are moved to accounts controlled by DPRK actors.

CrowdStrike describes several ways laptops get diverted to a farm:

1. Filing a fake theft report so a replacement ships to the farm address.
2. Rotating residential addresses to obscure the final destination.
3. Claiming a last-minute relocation to redirect a device mid-shipment.
4. Abusing IT staffing roles to quietly reroute shipments.

CrowdStrike also reports that after public exposure, operatives increasingly spoofed device identifiers or reused identifiers across victim organisations. It expects limited near-term impact from this operation but calls it the start of a broader effort against Famous Chollima's U.S. infrastructure.

Why this is a security problem, not just an HR one

A farm laptop is a fully trusted corporate endpoint controlled by someone outside the company. Whatever the worker can reach, so can whoever operates the remote-access tooling. The risk is data theft and extortion as well as salary fraud, which is why this class of case belongs with insider-threat and access reviews.

What to check this week

• Shipping and replacement requests: review laptops shipped to addresses that changed after hiring, and replacements issued after theft reports.
• Remote-access software: look for unapproved remote-desktop tools and hardware KVMs on issued laptops.
• Identity checks: require live, verified identity checks at hiring and again at device activation, including for contractors and staffing-agency hires.
• Device identity: make sure device identifiers are bound to the managed endpoint so reuse across tenants or users is visible.
• Access scope: give new remote workers only the data and systems their role needs.

The question to take away

If one of your remote hires from the last two years turned out to be an operator overseas working through a laptop in someone's spare room, how much of your data could they reach, and would you know?

Talk to us about scoping AI access for remote and contract teams.