On October 13, 2026, the Department of Justice (DOJ) announced that it made two arrests, searched multiple laptop farms, and seized 187 computer devises used by the Democratic People’s Republic of North Korea (DPRK) to defraud U.S. based companies to “fund its regime through remote information technology (IT) work for U.S. companies.” The coordinated effort, dubbed “operation Lonestar Roundup,” took place primarily in Ohio and Texas.
According to the DOJ’s press release, “North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.” The Federal Bureau of Investigation (FBI) and DOJ successfully deployed a coordinated effort against the scheme and “secured charges against 14 individuals, conducted two arrests, seized nearly 190 devices, and executed operations at more than 40 suspected “laptop farms” across Texas. Disappointing was the arrest of two U.S. nationals, along with ten Chinese nationals, and two unidentified individuals involved in the multi-year fraud scheme. The scheme worked like this:
According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.
More than 70 U.S. companies were affected, and the scheme generated over $3 million in revenue. “Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.”
In conjunction with the announcement, the FBI issued a public service announcement to assist companies with mitigation guidance. Companies that employ remote IT professionals should pay close attention to recruiting and hiring practices to prevent becoming a victim.
To learn more about actions against North Korean cyber threat actors, click here.
Recent Comments