THE FBI conducted a coordinated enforcement action in Texas as part of an ongoing effort against North Korea’s remote IT-worker schemes. In Operation Lonestar Roundup, 40 homes were searched and about 187 laptops and KVM switch devices were seized. The operation targeted North Korean IT workers who used stolen or fake US identities to secure remote roles in American companies, routing the wages back to DPRK entities.
The DoJ says the scheme ran from 2019 to mid-2025, touching more than 70 US employers across 17 states and spanning sectors such as healthcare, communications, cyber security support, retail and manufacturing.
According to the indictment and DoJ press materials, North Korean workers applied for roles, used VPNs and proxy servers to simulate US-based work, and relied on US-based helpers who supplied and configured laptops with remote-access software. The helpers were compensated for their part, while the illicit earnings flowed to sanctioned North Korean entities.
Investigations, with CrowdStrike’s assistance, describe the operation as “laptop farm” infrastructure used to maintain plausible remote-worker personas and to siphon wages back to the regime. The FBI public service announcement notes the broader scale of the threat, warning that thousands of DPRK IT workers are embedded in Western companies and that individual earnings could reach about $300,000 per year, with revenue measured in hundreds of millions annually.
The DOJ notes this is the first round of actions under the DPRK RevGen Domestic Enabler Initiative, aimed at dismantling associated infrastructure and networks.