North Korean laptop farms operating in ordinary houses have turned remote hiring into a national-security risk. Picture the ideal remote developer. Strong résumé, sharp in interviews, delivers on time. Now picture the company laptop you shipped them sitting on a folding table in a house in North Texas, next to dozens of others, while the person actually using it logs in from the other side of the world. That’s the scheme federal investigators say they just disrupted, and a lot of it was happening in our backyard.
What Happened with the North Korean Laptop Farms
Between September 21 and 25, the FBI searched 40 residences in Texas suspected of hosting “laptop farms” as part of an operation code-named Lonestar Roundup. The U.S. Attorney’s Office for the Northern District of Texas announced the results on October 13. Agents seized approximately 187 laptops and keyboard-video-mouse (KVM) devices that prosecutors say were used by North Korean IT workers to hold remote jobs at U.S. companies under stolen or fake American identities.
“In North Texas alone, we seized more than 100 laptops,” said Joseph Rothrock, Special Agent in Charge of FBI Dallas. He also put the scope in plain terms: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.” The seizures from these North Korean laptop farms underscore how widespread the problem had become in the region.
Separately, the Justice Department unsealed an Ohio indictment describing a remote IT worker scheme that allegedly ran from 2019 to July 2025, affected 70 U.S. companies, and generated roughly $3 million for North Korea. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on charges of wire fraud, money laundering, and identity theft. BleepingComputer reports that 14 people were charged in total, including 12 Chinese nationals. These are charges, not convictions.
How the Scheme Works
CrowdStrike, which tracks the group as Famous Chollima and supported the FBI’s work, has followed this activity since April 2025. The playbook goes like this. Operatives apply for remote technology roles using stolen, rented, or fabricated identities, often for software engineer and web developer positions. Once hired, they need the company laptop to land somewhere in the U.S. instead of the address on their documents. According to CrowdStrike, they’ve done that by:
- Filing fake theft reports so the employer ships a replacement laptop to the farm’s address
- Rotating through residential addresses to hide where devices really end up
- Claiming last-minute relocations to redirect shipments already in transit
- Abusing IT staffing roles they sometimes hold to quietly reroute equipment
At the farm, U.S.-based facilitators set up the laptops, install remote-access software, and send the paychecks to accounts controlled by North Korea. VPNs and proxies make the workers look like they’re logging in from the U.S. Rothrock said state organizations collect an estimated 85 to 90% of what the workers earn, and the money funds the regime’s weapons programs. These North Korean laptop farms solved the physical-location problem that would otherwise expose the overseas workers.
This Isn’t Just About Paychecks
A fraudulent hire is an insider with real credentials. BleepingComputer notes that in some cases these operatives also try to compromise their employers’ networks to steal sensitive data, deploy malware, or take cryptocurrency and other assets. The companies affected weren’t only big defense contractors, either. Prosecutors listed health care, communications, cyber support, retail, and manufacturing, and CrowdStrike named businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering, and government technology.
Don’t expect this to be the last word. CrowdStrike called the raids “the beginning of a broader U.S. law enforcement effort” but expects only limited impact, because operatives adapt. It has already seen them spoof device identifiers and reuse identifiers across victim organizations. The FBI says it’s reaching out to affected local companies, and U.S. Attorney Ryan Raybould said he expects more facilitators to be indicted. The disruption of North Korean laptop farms is significant, yet the underlying tactics continue to evolve.
Why This Matters for Your Organization
Remote hiring is how most businesses fill technical roles now, and this scheme exploits exactly the steps many companies treat as routine: a video interview, a background check on whatever identity was provided, and a laptop shipped to whatever address was given. If your hiring process, your IT team, and your security monitoring never compare notes, a fake employee can slip through the gaps between them. The existence of North Korean laptop farms shows that identity verification and equipment logistics are now critical security controls.
Federal investigators also released a list of email addresses linked to the scheme and encouraged employers to add them to the indicators they use to screen candidates.
How to Spot and Stop a Fake Remote Hire
- Verify identity more than once: a live, camera-on interview, then again at onboarding, compared against the identity documents you collected.
- Ship equipment only to an address you’ve verified, and treat any request to change it, especially a “stolen laptop” replacement going to a new address, as a red flag that needs a second look.
- Ask your staffing partners exactly how they verify the people they place with you.
- Watch new-hire devices for remote-access tools you didn’t install, and for logins routed through VPNs, proxies, or unexpected locations.
- Give new hires only the access their role needs, and expand it over time.
- Make sure HR, IT, and security share signals instead of working in separate silos.
These practical steps reduce the chance that a device ends up in one of the North Korean laptop farms still operating elsewhere.
The Takeaway
The most dangerous intruder is the one you onboarded yourself. North Korean laptop farms show that identity risk doesn’t stop at passwords and MFA. It starts with who you hire and where their equipment really goes. For North Texas businesses in particular, this is a reminder that nation-state threats aren’t something that only happens to someone else.
If you’re not confident your hiring and onboarding process would catch a fake remote employee, Black Belt Secure can help you tighten it up. Schedule a free assessment today.
Source: BleepingComputer (Oct 14); Nextgov/FCW (Oct 13); NBC 5 Dallas-Fort Worth (Oct 13).