US authorities have dismantled dozens of suspected laptop farms in Texas as part of an investigation into North Korean operatives secretly obtaining remote technology jobs at American companies. The operation resulted in two arrests, charges against 14 individuals, and the seizure of approximately 187 computers and related devices.
The FBI conducted searches at more than 40 Texas residences between September 21 and 25, 2026, under an operation named Lonestar Roundup. Investigators believe these properties were used to conceal the real locations of North Korean IT workers employed by unsuspecting US businesses.
A laptop farm is a location where company-issued computers are kept and remotely operated by people elsewhere. In this case, facilitators allegedly received work laptops at American addresses, installed remote-access software, and allowed overseas workers to connect to them, making their activity appear to originate from the United States.
The Justice Department also announced the arrests of Michael James Bostelle, a Pennsylvania resident, and Juan Cecilio Pena Carrillo, from Texas. Both face charges involving wire fraud, money laundering, and identity theft in connection with the alleged operation.
According to prosecutors, the broader conspiracy affected more than 70 American companies between 2019 and 2025, generating approximately $3 million in employment revenue. The money is believed to have been transferred to entities controlled by North Korea, potentially supporting the country’s sanctioned weapons programs.
Affected employers operated in industries including healthcare, communications, cybersecurity, retail and manufacturing. Investigators say the workers used stolen or fabricated identities, misleading employment documents and internet connections designed to disguise their actual locations.
Cybersecurity company CrowdStrike has tracked the activity under the name Famous Chollima, also known as WageMole. Its researchers identified techniques used to redirect employer-issued laptops to facilitators, including false relocation claims, manipulated shipping arrangements and fraudulent reports of missing equipment.
The FBI has warned that North Korean operatives are adapting their methods as employers improve identity verification. Some now recruit intermediaries to attend interviews, complete work assignments or provide access to professional accounts, while others subcontract jobs to freelancers.
Beyond financial losses, these arrangements can expose corporate networks and confidential information to unauthorized individuals. Previous North Korean IT worker operations have also involved data theft and extortion.
Authorities are urging businesses to strengthen remote hiring procedures, verify applicants’ identities, and investigate unusual device shipments or remote-access activity. The investigation remains ongoing, and all defendants are presumed innocent unless proven guilty.