Texas Laptop Farm Raids Seize 187 Devices in Alleged North Korean IT Employment Scheme

Residential computer networks become a national security target

Federal agents searched more than 40 Texas residences between September 21 and September 25 and seized approximately 187 laptops and other electronic devices in an investigation into alleged North Korean employment fraud. More than 100 devices were recovered in North Texas, where authorities said homes around the Dallas and Fort Worth area served as bases for overseas workers posing as American employees.

The operation, called Operation Lone Star Roundup, targeted a physical support network behind apparently ordinary remote jobs. Prosecutors say American facilitators received computers from employers, installed equipment or software allowing access from abroad, and helped route wages to accounts controlled by North Korean operatives.

U.S. Attorney Ryan Raybould, who leads the Northern District of Texas prosecutor's office, said the revenue supports the Democratic People's Republic of Korea's nuclear and ballistic missile programs. He attributed to the U.S. Treasury an estimate that the broader North Korean IT worker program generated more than $800 million in fiscal year 2024.

Reports differ on the criminal proceedings accompanying the seizures. Accounts of a Tuesday news conference said indictments against American facilitators were expected and no arrests had been announced. Other accounts describing a Justice Department announcement dated October 13 said two Americans had been arrested and an indictment charged ten people based in China. Those descriptions should not be treated as a single, fully reconciled procedural account.

The distinction matters: the seizures document a disruption of suspected infrastructure, while criminal charges set out allegations against particular people. Neither a seized computer nor an indictment establishes guilt.

What agents seized across Texas

The statewide seizure total is described in some accounts as more than 185 devices and in more detailed accounts as 187. Those figures are compatible rather than contradictory. Descriptions of the search locations vary between roughly 40 locations and more than 40 residences.

The equipment included laptops and keyboard, video and mouse devices, commonly called KVM equipment. These devices can let an operator control a computer's keyboard input, display and mouse from another location. Used alongside remote access software, they can allow someone overseas to operate a company computer housed in an American residence.

Authorities did not disclose the addresses of the Texas properties. They described a concentration near Dallas and Fort Worth and attributed the area's exposure partly to its large employment market. Accounts also differ slightly on the regional seizure count, describing it as either about 100 or more than 100 devices.

R. Joseph Rothrock, special agent in charge of the FBI's Dallas field office, explained why the hardware mattered to investigators:

Each laptop seized potentially represents one company that has hired a DPRK IT worker.

That is a measure of potential exposure, not a confirmed count of separate employers. The 187 devices included equipment other than laptops, and multiple computers could belong to the same company. The seizure total therefore cannot be converted directly into a victim company total.

How a laptop farm makes an overseas worker appear domestic

The alleged arrangement begins before an employer ships a computer. Workers apply for remote IT positions using stolen or fabricated identities, while other participants help satisfy hiring checks. Once a company believes it has hired a legitimate employee in the United States, it sends equipment to an address controlled by a facilitator.

The facilitator then hosts the laptop and configures remote access. Virtual private networks, or VPNs, and proxy servers help disguise the location of the person connecting. A VPN routes internet traffic through another connection; a proxy acts as an intermediary. Neither tool is inherently criminal, but authorities say this network used them to conceal workers' identities and whereabouts.

A laptop physically connected in Texas can make the employment arrangement appear domestic even when the person operating it is abroad. The local address, employer computer and concealed connection work together to support that appearance.

Accounts differ on where the workers themselves were located. Some descriptions place them in North Korea, while the indictment accounts identify operators based in China and describe overseas workers more broadly. The alleged scheme should not be understood as requiring every worker to have been physically inside North Korea.

The Texas investigation follows earlier scrutiny of the global IT worker scam, including the use of false identities and American intermediaries to obtain foreign wages. This operation adds a detailed picture of the residential infrastructure that can make those jobs possible.

American helpers allegedly handled more than computers

Investigators described facilitators as participants in hiring, identity verification and payment handling, rather than simply people providing shelf space for laptops. Some allegedly received salaries and transferred money to accounts controlled by North Korean workers. Others allowed their own names and personal information to be used in exchange for proceeds.

Rothrock described the range of assistance authorities were investigating, including the difference between identities stolen from unsuspecting people and identities supplied by willing participants:

They may use stolen identities of unsuspecting Americans to obtain U.S. IT workers' jobs," Rothrock said. "In other instances, they pay individuals to use their identities or to complete other tasks, including appearing at interviews, verifying stolen identities, shipping packages, hosting laptops, and completing drug testing or fingerprinting.

Those alleged activities show why investigators are examining more than internet connections. A substitute interview participant or someone completing a physical screening could help an overseas applicant pass checks that software alone cannot bypass.

Raybould said people who knowingly hosted the equipment would face prosecution. His warning does not settle the knowledge or intent of any particular person, which would have to be established through evidence in the relevant criminal proceedings.

Arrest accounts identify two Americans and ten operators in China

Accounts describing the Justice Department's October 13 announcement identify the arrested Americans as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. They say the men face charges including wire fraud, money laundering and identity theft in connection with the alleged employment scheme.

The same accounts identify ten charged participants based in China: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long.

An indictment reportedly alleges that operators in China directed Pena Carrillo, Tey Michael Nolte and at least four other Americans. Nolte was named in the indictment but was not charged. He allegedly recruited, managed and trained Bostelle and other American participants. Being named in an indictment is not the same as being a defendant.

These accounts say the alleged fraud affected more than 70 American companies, compromised the identities of 25 Americans, generated at least $3 million for overseas IT workers and caused false information to be submitted to multiple U.S. government agencies. They do not identify all affected employers or specify which agencies received that information.

Attorneys for Bostelle and Pena Carrillo were not immediately reached for comment, according to those accounts. No response from Nolte was reported. The allegations remain unproven, and the reports do not resolve how these arrests relate procedurally to the North Texas news conference's promise of forthcoming indictments.

The money figures describe different scales

The $800 million and $3 million figures should not be combined. Raybould's estimate of more than $800 million concerns the broader North Korean IT worker program in fiscal year 2024. The allegation of at least $3 million concerns the employment scheme described in the indictment accounts.

Descriptions of the Treasury estimate also vary. Some say more than $800 million was sent to North Korea; others describe that amount as revenue generated by the program. Revenue earned and money transferred are different measures, so the figure should not be presented as a precisely documented transfer total without further clarification.

Officials also described workers as sending an estimated 85% to 90% of their earnings to North Korea. On that account, every $100 earned would leave roughly $10 to $15 outside the amount remitted. That illustrates the alleged payment structure, but it does not establish the distribution of every salary in the Texas investigation.

The financial allegation explains why prosecutors view the case as more than employment fraud. Authorities say American wages become a source of funding for a sanctioned government and its weapons programs. The accounts do not trace individual Texas salary payments to particular weapons purchases.

Corporate access creates a separate security exposure

A successful fraudulent hire can obtain more than a paycheck. Raybould said access to company laptops could also provide an entry point into business systems, communications and financial platforms. The scope would depend on the permissions attached to each job.

CrowdStrike, the cybersecurity company that said it supplied intelligence and technical analysis supporting the FBI, tracks the network as Famous Chollima. A description of a court application also says that a major cybersecurity company assigned that name to the threat group. It is a tracking label, not a separate criminal charge.

CrowdStrike said organizations identified in the disrupted operations included businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering and government technology. That range shows potential exposure across sensitive industries, but it does not establish that every affected organization lost data.

The company described tactics used to redirect employer equipment. Some operatives allegedly filed false police reports claiming laptops had been stolen so replacements would be sent elsewhere. Others claimed sudden moves or obtained jobs through staffing firms, allowing computers to be redirected without those firms knowing.

These details connect the hiring deception to the physical farms: a worker needs both an accepted identity and a way to get the employer's computer into a location controlled by the network. Authorities have not disclosed a complete inventory of data accessed or stolen in the Texas operation.

The investigation extends beyond the Texas searches

The FBI identified 11 Google accounts allegedly connected to employment fraud, according to a description of court records. Investigators sought account information from each account's creation through October 8, including subscriber details, addresses, phone numbers, connection times, IP addresses, and payment and billing records.

A federal court in the Northern District of Texas reportedly issued an order on October 9 requiring Google to provide the records within ten days. That interval points to October 19 as the stated production deadline. There is no confirmation in the accounts that Google had completed production.

The principal reported dates are:

• September 21 to September 25: FBI searches and related action at more than 40 Texas residences.
• October 8: End of the period covered by the request for records from 11 Google accounts.
• October 9: Reported court order directing Google to produce account records within ten days.
• October 13: Date attached to accounts of the operation announcement and related criminal proceedings.

Officials also described similar activity in Louisiana, Nevada, Kentucky and Ohio. CrowdStrike said the broader disruption included two arrests in Ohio, but did not identify those arrested or their charges. The Texas announcement did not address those arrests, so they should not automatically be counted as either separate from or identical to the two named American arrests.

What employers were told, and what is still unknown

Raybould and Rothrock urged employers to use E-Verify and require multiple forms of identification when hiring remote workers. E-Verify checks employment eligibility information against government records. That addresses one part of the hiring process, while the alleged use of substitute interview participants and remotely controlled laptops demonstrates that the identity of the person doing the work is a separate concern.

Authorities encouraged businesses and individuals who believe they were affected to report information to the FBI. They did not publish a full employer list, the residential addresses searched, or a complete accounting of wages intercepted or recovered.

The investigation remains active. No dates for further indictments, hearings or trials were given in the accounts describing the North Texas briefing. The conflicting descriptions of arrests and expected charges leave the precise relationship between the announcements unresolved.

CrowdStrike cautioned that shutting down farms would probably slow activity mainly where infrastructure was removed, rather than produce a lasting end to the wider operation. The seizures show that authorities can interrupt the local equipment network. They do not establish that all workers, identities, accounts or facilitators connected to it have been found.

Key Points

• Agents searched more than 40 Texas residences in late September and seized approximately 187 laptops and other devices.
• Authorities said more than 100 devices were recovered in North Texas, although one account described the count as about 100.
• The alleged farms let overseas workers control employer computers housed in American homes and appear to work domestically.
• Reports differ between a promise of forthcoming indictments and an announcement of two American arrests and charges against ten people based in China.
• The indictment accounts describe more than 70 affected companies, 25 compromised American identities and at least $3 million in revenue.
• The estimate exceeding $800 million concerns the broader North Korean IT worker program, not the Texas seizures alone.
• Investigators sought records for 11 Google accounts, and the inquiry remains ongoing.