Another "laptop farm," serving as a remote base for North Korean information technology (IT) workers who stealthily secured employment at U.S. companies, has been uncovered.

Through a separate investigation, U.S. law enforcement authorities arrested two domestic accomplices aiding the North Korean IT worker infiltration and indicted over 10 individuals, including a supervisory mastermind residing in China.

The U.S. Federal Bureau of Investigation (FBI) and the U.S. Attorney's Office for the Northern District of Texas announced on the 13th (local time) that they had dismantled an illegal network of North Korean IT workers through a joint statewide operation named "Operation Lone Star Roundup."

During the operation, authorities searched around 40 residences and seized 187 items, including laptops and KVM (keyboard, video, mouse) devices that had been misused by North Korean workers to unlawfully infiltrate U.S. companies.

"Operation Lone Star Roundup was conducted to disrupt malicious cyber activities carried out by the North Korean government to support weapons of mass destruction (WMDs), ballistic missiles, intelligence programs, and nuclear programs," pointed out R. Joseph Rothrock, Special Agent in Charge of the FBI Dallas Field Office, adding, "Each seized laptop represents a company that hired North Korean IT personnel."

Investigations revealed that the North Korean workers secured jobs by disguising themselves as remote workers residing within the United States, utilizing stolen or forged U.S. identification documents and virtual private networks (VPNs) capable of manipulating internet connection locations.

Domestic accomplices assisting North Korea received remote work laptops sent by victimized companies at their homes, set them up, and installed remote access software to provide laptop farms that allowed North Korean hackers and workers to access them freely.

They were also responsible for receiving salaries and remitting them to accounts controlled by the North Korean regime.

U.S. cybersecurity firm CrowdStrike has dubbed the group of North Korean IT operatives engaging in such crimes and the networks aiding them "Famous Chollima."

Federal Prosecutor Ryan Raybold pointed out, "This investigation goes far beyond a simple fraud case," adding, "We will not sit idly by while America's adversaries exploit our businesses or threaten our national security."

Raybold specifically warned of legal actions against domestic accomplices who helped North Korea, stating, "It is absurd for someone to keep dozens of laptops in their living room while claiming to the government that they 'did not know what was going on.'"

Investigative authorities disclosed 11 email accounts utilized in the crimes and appealed for tips.

Meanwhile, the U.S. Department of Justice announced that it indicted domestic accomplices and co-conspirators residing in China uncovered through a separate investigation regarding the disguised employment of North Korean IT workers, while also releasing the indictments.

According to the Department of Justice's announcement, the U.S. Attorney's Office for the Northern District of Ohio arrested and prosecuted Michael James Bostel, a resident of Pennsylvania, and Juan Cecilio Peña Carrillo, a resident of Texas, on four charges including wire fraud and money laundering.

U.S. prosecutors jointly indicted 10 individuals residing in China, including ringleader Sun Shengming (rendered in Chinese pronunciation as Sun Shengming) based in Dandong, China, along with two unnamed co-conspirators.

Investigations showed that they participated from 2019 to July 2025 in helping North Korean IT workers fraudulently secure remote employment by posing as U.S. citizens using forged identity documents.

U.S. nationals Bostel and Peña Carrillo were found to have acted as domestic accomplices aiding the disguised employment by operating laptop farms.

Among the 10 individuals residing in China whose names were written in Chinese pronunciation in the indictment, some were specified as Chinese nationals, while the nationalities of others were not specified.

They were found to have received money or packages sent by domestic accomplices in China.

Due to their disguised employment activities, about 70 U.S. companies suffered damages, and the fraudulent workers generated approximately 3 million dollars in revenue.

The Department of Justice explained that the crime proceeds are estimated to have flowed into sanctioned entities controlled by North Korea.

The Department of Justice stated that the FBI's Cleveland Field Office is continuing its investigation related to this case.

"The Justice Department's National Security Division, alongside partner law enforcement agencies, will track down all those aiding North Korea and utilize all available means to protect national security," said John Eisenberg, Principal Deputy Assistant Attorney General for the Department of Justice's National Security Division.

This is not the first time such laptop farms, exploited as a means of earning foreign currency for North Korea, have been uncovered.

The U.S. Department of Justice stated in June of last year that it had uncovered 29 laptop farms across 16 U.S. states, and a woman from Arizona was sentenced by a court to 8 years and 6 months in prison for aiding North Korea through a laptop farm uncovered in 2023.

Texas local broadcasting station Fox 4 reported, citing Treasury Department estimates, that revenue earned by North Korean IT workers through such methods reached approximately 800 million dollars (about 1.08 trillion won) in the year 2024 alone.

(Photo: Provided by U.S. Department of Justice, Yonhap News)