FBI raids 40 Texas laptop farms tied to North Korean IT workers

The FBI searched more than 40 homes in Texas between September 21 and 25 that it believes were run as "laptop farms" for North Korean IT workers, the Justice Department said on October 13. Agents seized about 187 laptops and KVM switches, the devices that let one person control several computers. Officials told FOX 4 that more than 100 of the devices came from North Texas, and that the sites were concentrated around Dallas-Fort Worth.

A laptop farm is a house where a US resident keeps company laptops shipped to a remote hire. The worker, who is actually overseas, logs in to them from abroad, so the employer sees a US address and a US IP address. For IT teams the issue is not only fraud. The person on the other end has normal employee access to code, tickets, cloud consoles and customer data.

The charges

In a separate case in Ohio, a four-count indictment names 12 defendants on charges of wire fraud, money laundering and identity theft. Two US citizens were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten defendants are based in China, and two more are under seal.

The indictment says the scheme ran from 2019 to about July 2025, earned the IT workers more than $3 million and placed them with more than 70 US employers in health care, communications, cybersecurity support, retail and manufacturing. Those employers were spread across Ohio, 16 other states and Washington, D.C. Charges are allegations, and the defendants are presumed innocent.

No arrests have been announced from the Texas searches. US Attorney Ryan Raybould told reporters that a person keeping 50 laptops at home is "doing something wrong."

CrowdStrike worked with the FBI on the Texas operation and tracks the group as Famous Chollima. The Justice Department also published 11 Gmail addresses tied to the schemes so that companies can add them to applicant screening.

What the FBI says has changed

The FBI issued a new public service announcement the same day. It says the North Korean workers now:

• pay more US residents to act as facilitators, and sometimes hand the actual work to freelancers in South Asia or West Africa
• spread their laptops across many smaller farms, so one raid takes down fewer jobs
• buy identity verification services to get through background checks
• go after cleared or specialist roles, including at government contractors
• in some cases threaten former managers and their families

The FBI lists signs an employer can look for on company devices: remote access tools such as AnyDesk, TeamViewer or Chrome Remote Desktop; KVM switches that work over the network; screen streaming software (OBS Studio with a VDO.Ninja plugin) or developer tools like Homebrew on a machine that should not need them; and frequent changes to bank details and home addresses in HR records.

The FBI warns that no single sign is proof, and that blunt filters such as name lists can hurt real applicants and identity theft victims. It asks IT, HR and security teams to compare notes. Suspected cases go to the local FBI field office and to IC3.