FBI Seizes 187 Devices in Texas Crackdown on North Korean IT Worker Scheme Funding Nukes
Federal agents searched more than 40 Texas residences and seized 187 laptops and related devices in an operation targeting North Korean remote IT workers who used stolen American identities to generate revenue for Pyongyang’s weapons programs.
Tommy Flynn
The FBI and Justice Department announced coordinated actions against a North Korean scheme in which IT workers used stolen or fabricated American identities to obtain remote jobs at U.S. companies, with U.S.-based facilitators housing the employer-issued laptops so the overseas workers could access corporate systems while concealing their location.
Under Operation Lonestar Roundup, agents searched more than 40 residences in Texas between September 21 and 25 and seized approximately 187 laptops and keyboard-video-mouse (KVM) devices. Roughly 100 of the devices were recovered in North Texas. The operation was coordinated with the U.S. Attorney’s Office for the Northern District of Texas and the FBI’s Dallas Field Office and Cyber Division, with assistance from the cybersecurity firm CrowdStrike.
“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” said FBI Cyber Division Assistant Director Brett Leatherman. “Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer.”
U.S. Attorney Ryan Raybould said the investigation “is about far more than fraud.” FBI Dallas Special Agent in Charge R. Joseph Rothrock noted that each seized laptop potentially represents one company that hired a DPRK IT worker. North Korea’s government is estimated to take 85–90 percent of the revenue generated by the workers, according to an FBI advisory.
Separately, the Justice Department unsealed indictments in Ohio against two U.S. nationals and 10 China-based North Koreans accused of identity theft that bilked more than 70 companies out of more than $3 million between 2019 and 2025. Two arrests were made in connection with that case. The broader campaign, tracked by CrowdStrike as Famous Chollima, has been described by U.S. intelligence as a primary method for North Korea to evade sanctions and fund its nuclear and ballistic missile programs.
Support Independent Conservative News
RWTNews is independent conservative news — no corporate backing, no agenda driven by advertisers. We rely entirely on readers like you to keep the lights on and the truth coming. If you've found value in what you read here, consider supporting us with a one-time or monthly contribution. Every dollar goes directly toward keeping this site running and growing.
Secured by Stripe. Your payment info is never stored on our servers.