FBI disrupts North Korean corporate espionage ring in north Texas

Federal agents disrupted what they describe as “a major illicit laptop‑hosting network” that enabled North Korean IT workers to unlawfully access U.S. corporate systems using stolen or falsified American identities for the Democratic People's Republic of Korea (DPRK), authorities said. The U.S. has designated DPRK as a state sponsor of terrorism. 

The bust was made through a federal Operation Lonestar Roundup with the assistance of the U.S. cybersecurity firm CrowdStrike. FBI special agents executed searches at more than 40 residences in Texas, seizing 187 laptops and keyboards, video and mouse devices. The devices were used as part of a “laptop farm” for DPRK IT workers, according to the complaint. 

The majority were seized in north Texas. FBI agents seized approximately 100 devices that DPRK workers and their U.S.-based facilitators used to carry out the fraudulent scheme in north Texas, authorities said. The laptop farm was established to obtain remote employment and generate revenue for the DPRK’s sanctioned weapons programs, authorities allege.

“Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability,” Raybould said. “Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

Operation Lonestar Roundup in Texas was launched to disrupt “malicious cyber activity perpetrated by the North Korean government with the purpose of supporting its WMD and ballistic missile programs, intelligence program, and nuclear program,” FBI Dallas Special Agent in Charge Joseph Rothrock said. “Each laptop seized potentially represents one company that has hired a DPRK IT worker.”

According to investigative findings, DPRK IT workers applied for and obtained remote positions at U.S. companies by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure. The scheme made it seem as if they were physically located in the U.S. but were instead in North Korea, according to the complaint. To do this, they relied on U.S.-based facilitators “who received laptops from victim companies, housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts,” according to the complaint.

CrowdStrike has been working with the FBI to target DPRK operatives nationwide. In late September, it says its Counter Adversary Operations team collaborated with the FBI to disrupt several laptop farms operating nationwide maintained by DPRK-nexus adversary FAMOUS CHOLLIMA. Between April and June, its team identified the infrastructure, it says. 

FAMOUS CHOLLIMA is a North Korean state-sponsored hacking group involved in fraudulent IT-worker schemes that has been active since at least 2018, CrowdStrike says. It “likely conducts operations on behalf of North Korea's Munitions Industry Department (MID), which funds and oversees the DPRK's missile and nuclear weapons program.” 

The scheme involves DPRK operatives using laptop farms to enable FAMOUS CHOLLIMA operatives “to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations” in the U.S.. authorties allege.

In north Texas, investigators said they uncovered DPRK operatives using a network of fraudulent Google email accounts to facilitate the scheme. The DOJ published the emails in the complaint.

The bust comes as the Trump administration’s FBI is aggressively pursuing cybercrimes and corporate espionage. These investigations are an outworking of National Security Presidential Memorandum 11 (NSPM-11) issued to advance American superiority in artificial intelligence technology.

A federal investigation into DPRK illicit financial networks is ongoing.

The FBI is encouraging any company or individual who has information about the DPRK scheme to come forward and file a report at ic3.gov.