DOJ Raided More Than 40 Texas Laptop Farms After North Korean IT Workers Infiltrated 70 US Companies

Federal agents fanned out across Texas and searched more than 40 homes suspected of serving as laptop farms, the quiet back rooms where company-issued computers sit plugged in so North Korean IT workers can pretend to be American employees. They walked out with roughly 187 computers.

The Justice Department announced the sweep, dubbed Operation Lonestar Roundup, alongside charges against 14 people. According to prosecutors, the scheme planted workers inside more than 70 US companies and funneled about $3 million in salaries toward Pyongyang.

The Americans who kept the laptops running

An indictment unsealed in the Northern District of Ohio charges two US citizens: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Prosecutors say they worked with 10 others located in China to hold remote jobs at more than 70 companies from 2019 through 2025, using stolen or fabricated identities.

The roles were mundane, which is the point. Carrillo allegedly hosted company laptops at his home under various names and received about $190,000 from five employers. Bostelle allegedly lent his name and a fraudulent driver's license to help a remote worker land a job.

An Ohio resident, Trey Michael Nolte, is named as a co-conspirator but has not been charged. He allegedly kept around two dozen company laptops online for workers overseas, installed remote-access software on them and moved more than $320,000 through accounts opened under false names.

The paperwork went all the way to the federal government. False employment records were allegedly filed with DHS, the IRS and the Social Security Administration in the names of more than 25 identity-theft victims.

Who got fooled

The Justice Department did not name the employers. They span healthcare, cyber support, retail, communications and manufacturing, in Ohio and 16 other states plus Washington, DC. TechCrunch counted at least 70 US-based companies infiltrated.

Ryan Raybould, the US Attorney for the Northern District of Texas, described the case as a hostile foreign regime infiltrating American companies through stolen identities and covert access points. Every laptop farm dismantled, he said, shuts a revenue stream that funds weapons programs. The scheme feeds the same sanctioned weapons ambitions as North Korea's crypto heists, which TechCrunch estimates netted the regime at least $2 billion in 2025, separate from this case.

The tradecraft keeps adapting

CrowdStrike helped the FBI and tracks the operators as FAMOUS CHOLLIMA. Since May, the group has spoofed device identifiers, for example making a video capture card show up as a webcam, and reused disguised devices across multiple jobs.

The FBI's own warning is blunt. It says "thousands" of North Korean state-controlled IT workers sit inside Western companies, posing a national security and intellectual property insider threat. Under pressure, they now pay US citizens to sit job interviews, take drug tests, access accounts and keep company laptops running. Some subcontract the actual work to freelancers in Pakistan, India and Nigeria.

The pressure tactics are getting uglier, too. The FBI describes threats against former managers, extortion using stolen data and paid helpers sent to intimidate companies in person. Japan saw a version of the same playbook when it shut down a North Korean laptop farm tied to the WaterPlum cluster.

CrowdStrike is realistic about what a raid achieves. Taking down a laptop farm likely has limited lasting impact, mostly in the area where it happens, but it shows the operators they are being watched. Adam Meyers of CrowdStrike said disruption forces the adversary to rebuild and reinvest.

The State Department is offering rewards of up to $5 million for information that helps disrupt the scheme.

Some offers on this page may be paid placements or contain affiliate links.