The Justice Department announced Operation Lonestar Roundup, a coordinated enforcement action targeting more than 40 suspected laptop farms across Texas. Authorities seized approximately 187 laptops and keyboard-video-mouse devices used to give overseas operators remote control of employer-issued computers.
How the Scheme Works
A U.S. facilitator receives your company laptop, and a remote operator abroad takes control.
The model is straightforward and difficult to detect. A U.S.-based facilitator receives a company-issued laptop and keeps it at a residential address, then connects KVM hardware so a remote operator overseas controls the machine while appearing to work from inside the United States. KVM devices route keyboard, video, and mouse signals over a network, and that capability can make a foreign worker’s location invisible to some employer security systems.
The concealment is not guaranteed to succeed, but it exploits a common gap. If your company ships laptops to new hires without verifying the physical destination, that workflow is a documented exposure point.
What the FBI Found
The Justice Department confirmed the following operational facts from Operation Lonestar Roundup.
- More than 40 Texas residences searched between Sept. 21 and Sept. 25 under Operation Lonestar Roundup
- Approximately 187 laptops and KVM devices seized
- Seized devices allegedly supported fraudulent employment and generated revenue for North Korea’s weapons programs, per the DOJ
- The DOJ reported two arrests in the broader coordinated action and charges against 14 individuals; the release did not specify whether either arrest occurred during the Texas searches
- CrowdStrike, which tracks this activity cluster under the name “Famous Chollima,” provided intelligence and technical analysis to support the investigation
What This Means for Your Hiring Process
A stolen identity that clears your background check can carry legitimate credentials directly into your internal systems.
The financial stakes are documented. The Justice Department said one multi-year scheme generated more than $5 million in illicit revenue and cost victim companies at least $3 million in legal, remediation, and related costs. Earlier prosecutions connected the broader program to more than 100 U.S. companies, including Fortune 500 firms. At least 80 stolen American identities were used to place workers inside those organizations, per the DOJ.
This is not a new threat, and enforcement shows no sign of tapering. A June 2025 DOJ action searched 29 suspected laptop farms across 16 states and seized roughly 137 laptops. The Texas operation is larger in scope, not an isolated incident.
A fraudulent worker who clears your onboarding process does not just cost you salary. They may carry legitimate credentials into source code repositories, customer records, and internal systems, with the actual damage depending on what access your network grants them.
DOJ enforcement actions have increasingly targeted facilitators, identity brokers, and the front companies that allow these schemes to function at scale. If your remote-hiring process treats a successfully delivered laptop as confirmation of a worker’s location, that assumption warrants a direct review now.
