Between September 21 and 25, the U.S. Federal Bureau of Investigation (FBI) conducted raids at 40 residences in Texas, seizing approximately 187 computers and KVM devices believed to have been used in a scheme involving North Korean tech workers working remotely in jobs at U.S. companies. The operation, named Lonestar Roundup, took place in parallel with a U.S. Department of Justice action against the threat group known as Famous Chollima or WageMole.
The Department of Justice said authorities arrested U.S. citizens Michael James Bostelle and Juan Cecilio Pena Carrillo, and charged a total of 14 people with offenses including wire fraud, money laundering, and identity theft. The department also announced separate charges against 12 Chinese defendants.
How Did the Computer Farms Operate?
The facilitators hosted company-provided work computers at U.S. locations and then enabled workers located abroad to access them remotely using KVM devices and remote-access software. This made the worker appear to the employer as though they were located in the United States, even though their actual identity or location was different.
According to the article, the scheme relied on stolen or fabricated identities, VPN networks, and intermediary infrastructure to conceal the true source of the connections. The facilitators also received the computers, installed remote-access tools, and transferred the proceeds to accounts controlled by entities linked to North Korea.
Methods for Redirecting Devices and Concealing Their Trail
CrowdStrike said the workers used several methods to have company devices delivered to computer farms instead of the addresses listed in identity documents. These included falsely reporting a theft to obtain replacement devices, rotating multiple residential addresses, claiming to move at the last minute to redirect shipments, and exploiting jobs at staffing companies to change the destination of the devices.
CrowdStrike has tracked these workers’ activity since April 2025. The company believes that the exposure of previous methods prompted the operators to rely more heavily on spoofing device identifiers, and even to reuse some identifiers across different victim organizations.
What Is Changing in Practice?
The case shows that verifying an employee’s identity and location does not stop at the hiring interview or residential address. When an intermediary possesses a corporate computer, they can control a physical access point to the work environment, even when the technical connection appears to originate inside the United States. The risk therefore involves data theft, malware deployment, or access to digital assets, and not merely a violation of hiring rules.
The Department of Justice points to a separate scheme in Ohio that continued from 2019 through July 2025, affected 70 U.S. companies, and generated approximately $3 million for entities linked to North Korea. Nevertheless, the article quoted CrowdStrike as saying that the immediate impact of the current raid may be limited, describing it as the beginning of a broader U.S. effort to dismantle the group’s infrastructure inside the United States.