North Korean IT Workers Used Stolen US Identities to Earn $3 Million
FBI raids Texas laptop farms linked to a massive North Korean remote work scheme.
1Operation Lonestar Roundup Details
The FBI executed Operation Lonestar Roundup between September 21 and 25, raiding 40 Texas residences. Authorities seized 187 laptops and KVM switches used by North Korean intelligence agents. These devices were originally shipped by US companies to remote employees who were actually foreign operatives using stolen American identities to bypass security.
2Scope of the Scheme
Operating from 2019 to mid-2025, the scheme targeted over 70 US companies across 17 states. These victim organizations spanned sectors including healthcare, communications, cybersecurity support, retail, and manufacturing. The illicit operation successfully generated approximately $3 million in revenue, which was subsequently funneled back to sanctioned entities controlled by the North Korean regime.
3The Laptop Farm Mechanism
North Korean workers utilized VPNs and proxy servers to simulate a US-based presence. American facilitators were hired to receive company-issued hardware and install remote access software. This infrastructure, identified by CrowdStrike as laptop farms, allowed operatives to maintain persistent access to corporate networks while siphoning wages to the Ministry of Defense.
4Evolving Adversary Tactics
The threat is becoming more sophisticated as North Korean workers adapt to improved private sector detection. Operatives are increasingly hiring American facilitators to handle complex tasks or subcontracting entire jobs to third-party foreign nationals. This outsourcing strategy complicates attribution efforts and makes the interception of these illicit activities significantly more difficult for investigators.
5National Security Implications
The FBI warns that thousands of state-controlled IT workers are currently embedded within Western companies. These individuals pose a severe insider threat, potentially facilitating intellectual property theft and cyber intrusions. Individual operatives have reportedly earned up to $300,000 annually, contributing to a collective revenue stream measured in hundreds of millions for the regime.
6Enforcement and Legal Actions
This operation represents the fifth round of enforcement under the DOJ’s DPRK RevGen Domestic Enabler Initiative since June 2025. Two US nationals were arrested, and 14 individuals face charges across two separate indictments. The DOJ has released specific email addresses used in these schemes to help companies improve their internal hiring screening indicators.
7Identifying Red Flag Indicators
Companies are urged to monitor for specific warning signs during the hiring process. Common red flags include inconsistencies in provided work history, a persistent reluctance to appear on video calls, and requests to redirect laptop deliveries to non-residential addresses. Furthermore, payment accounts that route through intermediaries should trigger immediate internal security reviews.
8Strategic Cybersecurity Outlook
CrowdStrike reports that North Korean hackers were responsible for approximately half of all documented hands-on cyber intrusions over the past year. Beyond IT employment schemes, the regime actively targets cryptocurrency exchanges and open-source projects. In 2025 alone, these attackers successfully stole at least $2 billion, highlighting the regime's aggressive financial exploitation.