Front Page
Operation Lonestar Roundup dismantles North Korean IT worker network used to penetrate U.S. companies in Texas
By U.S. Department of Justice
Oct 14, 2026
Print this page
Email this article

Dallas, Texas -- United States Attorney for the Northern District of Texas Ryan Raybould and FBI Dallas Special Agent in Charge R. Joseph Rothrock today announced today that federal agents have disrupted a major illicit laptop‑hosting network that enabled Democratic People's Republic of Korea IT workers to unlawfully access U.S. corporate systems using stolen or falsified American identities.

As part of Operation Lonestar Roundup, the FBI executed searches of over 40 residences in the State of Texas seizing 187 laptops and KVM (keyboard, video, mouse) devices, all of which had operated as laptop farms for DPRK IT workers. In North Texas, agents seized approximately 100 devices that the DPRK workers and their U.S.-based facilitators used carry out the fraudulent scheme to obtain remote employment and generate revenue for the North Korean regime's sanctioned weapons programs.

"This investigation is about far more than fraud," said U.S. Attorney Ryan Raybould. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security."

"Operation Lonestar Roundup was aimed at disrupting malicious cyber activity perpetrated by the North Korean government with the purpose of supporting its WMD and ballistic missile programs, intelligence program, and nuclear program. Each laptop seized potentially represents one company that has hired a DPRK IT worker," said FBI Dallas Special Agent in Charge R. Joseph Rothrock. "The FBI will continue to work with our law enforcement and private sector partners to combat this threat. We encourage any company, or individual, who has information on this scheme to come forward and file a report at ic3.gov."

According to investigative findings, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were working from within the United States. They also relied on U.S.-based facilitators who received laptops from victim companies, housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.

U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as "Famous Chollima," a name that many victims now use to describe the broader threat network.

Investigators discovered that the DPRK operatives allegedly used a network of fraudulent Google accounts to facilitate their criminal activity. The following accounts were among those identified as being used in this plot:

The Department of Justice remains committed to disrupting DPRK illicit financial networks and protecting U.S. companies from covert intrusion schemes.

 

The investigation remains ongoing. Additional details will be released as appropriate.