Texas Laptop Farm Raids Expose a Remote Work Weak Point

The FBI searched 40 Texas residences in late September and seized 187 laptops and keyboard-video-mouse devices in an operation targeting North Korean remote-work schemes. The devices taken in Operation Lonestar Roundup had helped workers abroad operate employer-issued computers housed in the United States. A remote employee could be overseas while the machine connecting to a US company's systems sat in a Texas home.

That arrangement gives the scheme a physical dependency. Someone has to receive the laptop, keep it connected and make it accessible to the person doing the work. Seizing that equipment can interrupt access at the sites the FBI reached. The count of 187 includes both laptops and devices used to control them; it is not a count of distinct employers, workers or compromised networks.

The Texas searches sit alongside a separate Ohio indictment. Prosecutors allege that two US facilitators, Michael James Bostelle and Juan Cecilio Pena Carrillo, helped overseas workers obtain jobs at more than 70 US companies in a scheme running from 2019 to July 2025 and generating more than $3 million in fraudulent revenue. The two men were arrested. Those are allegations about the charged scheme, not a finding that the 187 devices in Texas belonged to 70 different companies.

The alleged revenue is one reason authorities pursue the workers. Access is another: an employer that hires someone under a false identity may grant that person ordinary access to company systems as part of the job. The risk to any one company depends on what the worker can reach. In an earlier case associated with federal action against laptop farms, prosecutors alleged that an overseas worker stole export-controlled technical information from a California defense contractor. That allegation illustrates the potential impact; it does not describe what happened at every company touched by the Texas operation.

How a Laptop Gets to the Wrong Desk

A company laptop at a US address can make an overseas worker's location harder to spot. The employer ships its device to what appears to be an employee's domestic address; a facilitator receives it and sets up hardware or software so someone elsewhere can operate it remotely. Prosecutors also allege that participants in the Ohio scheme used false identities, VPNs and proxies to conceal where the workers were. A familiar-looking device connection is one part of the disguise.

Getting the computer to the facilitator takes work. Operatives filed false theft reports to prompt replacement shipments, claimed last-minute moves and used staffing arrangements that allowed devices to be redirected without a firm's knowledge. Facilitators then configured the machines for remote access. A shipping change can therefore be an operational step in the fraud, even if the hiring paperwork initially looked consistent.

The facilitators' role extends beyond accepting parcels. The FBI has warned that people assisting these schemes may appear on camera, join interviews, verify identities, lend professional-networking accounts or keep work devices connected from their homes. Some Americans involved may be unwitting, the bureau says. A recruiter who sees a plausible video interview and an IT administrator who sees a laptop connecting from a US residence may each have checked a real thing. Neither check, by itself, establishes who is operating the computer after onboarding.

This is where the raid has a practical effect. Taking a hosted laptop away can break that worker's route into an employer's systems through that machine. It can also force the people running the scheme to arrange another address, another device shipment and another person willing to host equipment.

The Earlier Raids Offer a Useful Scale Check

Federal investigators had already pursued laptop farms before Lonestar Roundup. In June 2025, the Justice Department announced searches involving 29 known or suspected farms across 16 states. The Texas operation searched 40 residences in one state. The earlier count is of farms; the newer one is of residences searched. Those figures cannot show whether investigators found more farms or addresses this time, much less which action disrupted more workers or protected more companies.

An earlier case also shows why hiring-stage checks have uneven results. In a case disclosed in May 2024, participants allegedly tried to obtain contractor positions at Immigration and Customs Enforcement and the Federal Protective Service but could not meet fingerprinting requirements. Another participant secured a General Services Administration contractor position and was terminated five days after an introductory meeting. Fingerprinting blocked the attempts described in that case. It did not prevent every attempt to enter a federal contractor pipeline.

The Texas searches followed earlier multi-state farm searches, with investigators again targeting the physical setup. The sequence shows repeated enforcement, while employers still control the hiring and access decisions that make the equipment useful. Even a worker whose machine is removed may already have had access during employment; employers have to assess that exposure through their own systems and records.

CrowdStrike expects the latest shutdowns to slow activity mainly around the farms that were hit, with operatives adapting their methods. It has also described attempts to hide remote-access tools, spoof device identifiers and reuse identifiers across organizations. A device identifier, then, is a poor sole referee for whether the person using a company machine is the person hired to use it.

For employers, the FBI recommends what it calls “identity in depth”: layered checks and access controls from hiring through employment, with several concerning behaviors considered together. Applied to this scheme, that means treating an unexplained change in delivery address, unauthorized remote-control equipment or a mismatch in who attends meetings as reasons for closer review, rather than as automatic proof of North Korean involvement. IT teams can check whether remote-access tools are authorized and whether a shipped device is being used as expected. Recruiters, staffing firms and IT staff each see a different part of the route a laptop takes; a handoff between them is more useful than assuming one team has already settled every identity question.

Those checks have costs. Employees move, legitimate support staff use remote-management tools, and people have reasons to protect their privacy at home. A false alarm can affect a real worker's livelihood. The FBI's recommendation to combine signals offers a way to investigate discrepancies without treating an address change or unfamiliar software as a verdict. Companies deciding how much monitoring to use also owe employees a clear account of what they check and how they resolve mistakes.

The Texas searches reached machines and people that made a false US work location possible. Employers facing the same risk have a narrower question they can answer themselves: when a laptop arrives at an address, what confirms who uses it next?