Federal Agents Dismantle North Korean Remote Work Scheme in Texas
Dallas, Wednesday, 14 October 2026.
U.S. authorities seized nearly 190 laptops in Texas, uncovering a North Korean scheme using stolen identities for remote tech jobs to funnel millions into foreign weapons programs.
Federal Raid Disrupts Illicit Texas Tech Infrastructure
On October 12, 2026, the Department of Justice announced ‘Operation Lonestar Roundup,’ a coordinated federal effort led by U.S. Attorney Ryan Raybould for the Northern District of Texas, Assistant Attorney General John A. Eisenberg, and the FBI’s Cyber Division [2][3]. The enforcement action followed coordinated search operations executed between September 21 and September 25, 2026, during which federal agents raided more than 40 residential locations across Texas [2][4]. The crackdown uncovered extensive ‘laptop farms’—residential facilities where U.S.-based facilitators hosted corporate hardware to obscure the physical locations of foreign operatives [2][3].
Seizures, Arrests, and Corporate Infiltration Mechanics
During the September 2026 raids, law enforcement seized approximately 187 to 190 computer and Keyboard-Video-Mouse (KVM) devices across the state, with over 100 devices confiscated in North Texas alone [2][3][4]. According to cybersecurity firm CrowdStrike, which assisted the FBI Cyber Division in identifying the network, the overseas threat group operates under the designation ‘Famous Chollima’ [2][3][5]. The scheme involved using stolen or fabricated identities of American citizens to pass background checks and secure remote contract positions at more than 70 U.S. companies across diverse industries, including aerospace, energy, defense engineering, and health care [2][5].
Multi-Million Dollar Revenue Generation for Pyongyang
Between 2019 and July 2025, foreign IT operatives leveraging this infrastructure generated over $3 million through fraudulent remote work contracts across Ohio, 16 other states, and Washington, D.C. [2]. The U.S. Department of the Treasury estimates that broader DPRK remote employment schemes generate up to $800 million annually, with approximately 680 million to 720 million (between 85% and 90% of earnings) funneled directly back to Pyongyang to support sanctioned state interests, including weapons of mass destruction, ballistic missile, and nuclear programs [2][4].
Legal Unsealing and Ongoing Regulatory Guidance
The ongoing federal crackdown resulted in charges against 14 individuals, including ten China-based defendants, alongside the unsealing of indictments in Ohio on October 13, 2026 [2][5]. Two U.S.-based facilitators, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested in connection with the operations [2]. Following the joint Department of Justice announcements, the FBI’s Internet Crime Complaint Center (IC3) published a Public Service Announcement on October 13, 2026, delivering enhanced identity verification guidance for corporate hiring officers and enterprise risk managers [2].