FBI agents searched 40 Texas homes and seized about 187 laptops in a North Korean jobs scheme

FBI agents searched 40 residences across Texas between September 21 and 25 and carried away approximately 187 laptops and KVM devices, the hardware North Korean IT workers used to pose as American employees. Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested in the case.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The raids, codenamed Lonestar Roundup, went public only in mid-October, alongside the unsealing of a federal indictment in Ohio that names 14 defendants and describes a hiring fraud stretching across more than 70 American companies.

Lonestar Roundup and the Texas laptop farms

BleepingComputer’s account of the operation says the residences were suspected of hosting “laptop farms,” homes where company-issued computers sit powered on so that overseas workers can log in remotely. According to that report, agents seized roughly 187 laptops and KVM input devices, and the Justice Department’s own announcement of coordinated actions against North Korean remote IT workers puts the haul at nearly 190 devices.

The KVM switches matter as much as the laptops. A KVM lets a remote operator control a machine’s keyboard, video and mouse as though sitting in front of it, so an employer sees a login from a Texas address while the person typing is thousands of miles away. Facilitators also reportedly used stolen, rented or fabricated identities, fake theft reports, rotating addresses and last-minute relocation claims to redirect company shipments to the farms, and some abused IT staffing roles to do it.

The workers themselves rarely appear in person at all. They take the job under a stolen, rented or invented identity and rely on the American host to receive the hardware, keep it online and, according to the Ohio charges, install remote-access software on it. Paychecks then flow back toward accounts controlled by North Korea, which is why the laptops are treated as evidence of a revenue operation and not merely a hiring irregularity.

The Ohio indictment behind the arrests

The charging document came from the U.S. Attorney’s Office for the Northern District of Ohio. A grand jury returned the 58-page indictment on October 1, and prosecutors unsealed it on October 13. According to the office’s release on the 14 defendants, the scheme affected more than 70 U.S. companies in health care, communications, cyber support, retail and manufacturing, and produced about $3 million that is believed to have gone to sanctioned North Korean entities. BleepingComputer dates the scheme from 2019 to July 2025.

Twelve defendants are named and two remain under seal. Ten of the named defendants are listed with addresses in China, while Bostelle, of Philadelphia, and Pena Carrillo, of San Juan, Texas, are the two in custody. The counts include wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. The Justice Department notes that an indictment is only a charge, not evidence of guilt.

U.S. Attorney David M. Toepfer of the Northern District of Ohio said in the release: “These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.” Ryan Raybould, the U.S. Attorney for the Northern District of Texas, said Operation Lonestar Roundup “sends a clear message,” and FBI Cyber Division Assistant Director Brett Leatherman said close coordination between the private sector and federal law enforcement “was central to this operation.”

CrowdStrike and the limits of raiding farms

The private-sector partner Leatherman described was CrowdStrike. In a post dated October 13, the firm’s Counter Adversary Operations team said it worked with the FBI to disrupt several laptop farms run for Famous Chollima, the North Korea-linked group also tracked as WageMole. CrowdStrike reported that between April 2025 and June 2026 it identified personas, technical indicators and U.S.-based computers tied to the scheme, and that dozens of victim organizations in aerospace, energy, financial services and health care were affected.

CrowdStrike called the raids the beginning of a broader law enforcement effort to dismantle the group’s U.S. infrastructure, but also acknowledged, as BleepingComputer relays, that actions like this will probably have limited impact. Public exposure has pushed operatives toward spoofing device identifiers or reusing identifiers across victim companies, which makes each farm harder to spot from the employer’s side. A seizure also removes only the equipment in one house, while the workers, the personas and the payment routes sit elsewhere.

Prosecutions of the American helpers have been steady. The Justice Department announced in May that Matthew Isaac Knoot and Erick Ntekereze Prince were each sentenced to 18 months in prison, which BleepingComputer counted as the seventh and eighth U.S.-based laptop farmers sent to prison this year. In that case, Knoot received laptops addressed to a stolen identity at his Nashville residences, and victim companies paid more than $250,000 to workers tied to his operation.

Lonestar Roundup adds two more arrests to that tally, though ten of the named Ohio defendants, and the two sealed ones, remain at large. Toepfer’s warning about hiring practices is aimed at the employers that signed those workers up, which still have to find the next farm without a search warrant.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.