FBI Seizes Nearly 187 Laptops in Texas North Korean IT Worker Probe

The U.S. Department of Justice says an FBI operation in Texas disrupted infrastructure used in North Korean remote IT worker schemes. Authorities arrested two U.S. nationals, charged 14 people and seized nearly 187 laptops.

In an operation codenamed “Lonestar Roundup,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25. These sites hosted employer-issued computers that North Korean IT workers accessed remotely to appear to be based in the United States. Agents also seized KVM input devices.

Cybersecurity company CrowdStrike has tracked the operatives since April 2025. It said public exposure has pushed them to spoof device identifiers or reuse identifiers across victim organizations. CrowdStrike described the Texas operation as the beginning of a broader U.S. law enforcement effort, while acknowledging it would likely have limited impact.

A separate Ohio indictment describes a scheme that ran from 2019 to July 2025 and affected 70 U.S. companies, generating roughly $3 million for North Korean threat actors. The indictment says workers used stolen or fabricated identities, VPNs and proxy infrastructure, while U.S. facilitators hosted laptops, installed remote-access software and transferred earnings to DPRK-controlled accounts.

The two U.S. nationals arrested, Michael James Bostelle and Juan Cecilio Pena Carrillo, face wire fraud, money laundering and identity theft charges. The Justice Department separately announced similar charges against 12 Chinese defendants.