North Texas federal officials promise indictments after busting alleged North Korean "laptop farms"

Federal authorities have raided farms in 40 locations across North Texas — but the farms targeted by Operation Lone Star Roundup weren't harvesting food or raising livestock. 

They are called laptop farms that authorities say are controlled remotely in North Korea and used to steal U.S. jobs and money. 

Officials said indictments are coming after they seized more than 180 laptops they claim were part of a widespread operation supporting the North Korean government, something officials say threatens national security.

During a Tuesday morning press conference with the U.S. Attorney's Office for the Northern District of Texas, U.S. Attorney Ryan Raybould said the Democratic People's Republic of Korea (DPRK) uses information technology (IT) workers to earn wages from American companies, funneling that money to the North Korean government. Raybould said that money funds the DPRK's nuclear and ballistic weapons programs.

It starts with phony email addresses, along with social media profiles that help connect the online impostors in North Korea with remote employment here in the U.S. as software engineers or web designers.   

Raybould said the DPRK has done this for years, using the fake workers to obtain computers and run them out of "laptop farms" set up in American residences, including in North Texas. Those laptops, connected to special devices, are then reportedly able to grant the DPRK access to sensitive company data, personal information, and more. Raybould said the U.S. Treasury estimated this scheme generated more than $800 million in revenue for the DPRK in fiscal year 2024.

Joseph Rothrock, the Special Agent in Charge of the FBI Dallas field office, said federal agents carried out the North Texas operation, named Operation Lonestar Round-Up, in late September. There were similar operations elsewhere in Texas, as well as in Louisiana, Nevada, Kentucky, and Ohio. He said each laptop seized represented a potential company impacted.

Beyond computers, the U.S. Attorney's Office said several KVM devices were also seized. KVM stands for "keyboard, video, mouse", which enables remote access to multiple computers at once. Officials said the fake workers also used virtual private networks and proxy infrastructure to make it look like they were in the U.S., and that the group of workers and helpers were identified as "Famous Chollima".

Both Rothrock and Raybould urged companies to be vigilant when hiring remote workers and to rely on tools like E-Verify, as well as require multiple forms of identification for new hires.

"What we would continue to say to American companies is that we recognize your victim in this space," Rothrock said. "But there's things you can do to protect yourself, such as E-Verify, and just really do due diligence on those that you hire."

While no arrests have been made from the North Texas raids and seizures, the U.S. attorney hints that there will be. Raybould promised that people who willingly participated in the scheme by hosting the laptop farms would be indicted.

"It's very hard to claim you didn't know what you were doing when you're hosting 30, 40, 50 laptops in your house," said Raybould.

Businesses or individuals who believe they are impacted by this are encouraged to report information to the FBI online.