FBI DISMANTLES NORTH KOREAN LAPTOP FARM NETWORK IN TEXAS, SEIZES 187 DEVICES AND SEEKS COMPANIES TARGETED BY COVERT IT WORKERS

DALLAS, TEXAS — The Federal Bureau of Investigation (FBI) is seeking additional victims following Operation Lonestar Roundup, a coordinated federal investigation that dismantled a network of laptop-hosting facilities used by North Korean operatives to infiltrate American companies, obtain fraudulent remote employment, and generate revenue for the Democratic People’s Republic of Korea (DPRK). The operation resulted in the seizure of 187 laptops and other electronic devices across Texas, with the FBI Dallas Field Office issuing a renewed public appeal on November 10, 2026, to identify businesses whose equipment may have been involved.

Federal authorities initially announced the operation on October 13, following searches conducted between September 21 and September 25 at more than 40 residences across Texas. Investigators seized approximately 100 devices in North Texas alone, including computers and keyboard-video-mouse (KVM) equipment used to maintain remote connections to employer-issued systems. The devices were part of residential operations commonly known as laptop farms, allowing individuals physically located in North Korea to appear as legitimate remote employees working from within the United States.

According to the Justice Department, North Korean IT workers obtained employment by submitting stolen or fabricated American identities, falsifying professional credentials, and concealing their actual locations through virtual private networks and proxy infrastructure. Once hired, the operatives arranged for American companies to ship employment-related computers to domestic addresses controlled by facilitators. Those individuals received, configured, and maintained the devices while the workers accessed them remotely from overseas.

The scheme allowed North Korean personnel to operate within corporate environments using accounts and equipment issued to employees believed to be residing in the United States. Some facilitators installed remote-access software, maintained internet connectivity, managed multiple company-issued devices, and helped transfer earnings to accounts connected to the DPRK. Federal investigators linked the revenue generated through these arrangements to North Korea’s sanctioned weapons development programs, including its nuclear and ballistic missile activities.

U.S. Attorney Ryan Raybould for the Northern District of Texas described the operation as a national security investigation extending beyond ordinary employment fraud. FBI Dallas Special Agent in Charge R. Joseph Rothrock emphasized that each seized laptop could represent a company that unknowingly employed a North Korean operative, underscoring the importance of identifying affected businesses and determining whether corporate information or systems were compromised.

The network is associated with a broader North Korean cyber operation identified by cybersecurity researchers as Famous Chollima. Federal investigators also uncovered a collection of Google accounts allegedly used to coordinate fraudulent employment and related activities. Eleven email addresses were publicly identified in the investigation: Bright.star.me208@gmail.com, Merrttank.bz@gmail.com, randyryang@gmail.com, michaelb860102@gmail.com, assassinki211@gmail.com, dev.jerryyang@gmail.com, denis.turgenev2021@gmail.com, yesiree.cano825@gmail.com, thomasdenzelbrown@gmail.com, anthonyortega4592@gmail.com, and tyler.j.palmi38@gmail.com. Authorities identified these addresses as investigative indicators associated with the alleged scheme, not as proof that every communication involving them was criminal.

The operation follows an October 13 FBI Internet Crime Complaint Center (IC3) advisory, I-101326-PSA, warning that North Korean IT workers have expanded their recruitment of American facilitators to evade corporate security controls and federal investigations. The advisory describes operations in which individuals are paid to receive employment equipment, participate in video interviews, verify identities, operate professional networking accounts, and maintain computers connected to the internet.

The FBI also documented more aggressive tactics involving stolen personal information, unauthorized access to corporate data, and extortion. Investigators have observed North Korean operatives threaten former employers and facilitators with the disclosure of sensitive information or physical violence when fraudulent employment arrangements are disrupted. Some workers have also targeted companies holding federal contracts and positions requiring specialized technical qualifications or security clearances.

Federal authorities have warned that the use of legitimate remote-access software does not independently establish criminal activity. North Korean operatives have been observed using applications including AnyDesk, TeamViewer, RustDesk, and Chrome Remote Desktop, along with hardware-based remote management devices such as TinyPilot and PiKVM. These technologies have lawful administrative applications, but their unauthorized installation or use can allow individuals outside an organization to control corporate devices without the employer’s knowledge.

The FBI recommends that businesses adopt layered identity verification procedures throughout the hiring and employment process rather than relying exclusively on background checks or a single form of identification. Security personnel should examine unusual remote-access configurations, inconsistent employee information, unexplained changes in banking or contact details, and suspicious activity involving company-issued equipment. Coordination between human resources, information technology, and corporate security departments is particularly important when investigating potential employment fraud.

The November 10 appeal represents a new phase of Operation Lonestar Roundup focused on locating affected employers. The FBI is specifically seeking businesses that hired remote IT personnel and shipped laptops or related equipment to addresses in Texas during 2026. Companies that unknowingly participated in these arrangements may have exposed internal systems, proprietary information, or sensitive customer records to unauthorized access.

The FBI has established an official victim identification questionnaire for companies that believe their equipment may have been involved. Businesses are encouraged to provide relevant hiring records, shipping information, employee identities, and other evidence that could assist investigators. Participation is voluntary, and individuals or businesses identified as victims may qualify for federal victim assistance services, restitution, or other rights under applicable law.

The investigation remains active as federal authorities examine the seized equipment, trace the individuals responsible for maintaining the laptop farms, and identify additional businesses potentially affected by the operation. Although 187 devices were recovered, the FBI has not established that each device represents a separate company or that every affected employer suffered confirmed data theft. The total number of victims connected specifically to the Texas operation remains under investigation.

Operation Lonestar Roundup demonstrates how foreign intelligence-linked employment schemes can exploit legitimate remote-working arrangements to create persistent access points inside American businesses. The combined federal enforcement action and renewed victim identification effort are intended to disrupt those access pathways, identify compromised organizations, and restrict the flow of illicit employment revenue to North Korea’s weapons programs.

Businesses with information concerning the scheme can contact the FBI Dallas Field Office or submit a report through the FBI’s Internet Crime Complaint Center at ic3.gov. Companies that shipped employment-related computers to Texas during 2026 can also complete the FBI’s official Operation Lonestar Roundup victim identification questionnaire.

Federal Bureau of Investigation (FBI), Internet Crime Complaint Center (IC3) — “North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment,” Public Service Announcement I-101326-PSA, October 13, 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE