Federal agents searched more than 40 Texas homes and seized 187 laptops and other devices in a crackdown on a network that allegedly used stolen American identities to obtain U.S. jobs and generate money for North Korea’s weapons programs, federal authorities announced Tuesday.
The FBI carried out Operation Lonestar Roundup from September 21 to 25. Agents seized approximately 100 devices in North Texas, the U.S. Attorney’s Office for the Northern District of Texas said in its announcement.
The statewide total includes laptops and keyboard-video-mouse devices, known as KVMs, which can enable remote control of computers.
“This investigation is about far more than fraud,” U.S. Attorney Ryan Raybould said in the release.
Stolen identities and U.S. paychecks
North Korean information technology workers allegedly used stolen or fabricated identities to secure remote jobs, then relied on Americans to receive employer-issued laptops and keep them connected inside the United States, according to the government’s court application.
Facilitators housed the computers, installed remote-access software and transferred company payments to accounts controlled by North Korean workers, prosecutors alleged. The arrangements let overseas workers access corporate systems while concealing their locations.
“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” R. Joseph Rothrock, special agent in charge of FBI Dallas, said in the release. DPRK stands for Democratic People’s Republic of Korea.
North Korea’s government takes an estimated 85-90% of the revenue those workers generate, the FBI said in a new advisory Tuesday.
The broader IT worker schemes generated nearly $800 million in 2024 to help fund North Korea’s weapons programs, the Treasury Department said in March. That figure covers the broader schemes, rather than proceeds identified in the Texas operation.
Two arrests and a Google records order
The Justice Department also announced charges against 14 people and two arrests in an Ohio prosecution as part of its coordinated enforcement actions Tuesday.
Authorities arrested Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. A federal grand jury in the Northern District of Ohio returned the indictment October 1, charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft, prosecutors said.
That alleged scheme affected more than 70 U.S. employers and generated approximately $3 million for IT workers. Prosecutors believe the money went to sanctioned North Korean-controlled entities. The charges remain allegations, and the defendants retain the presumption of innocence.
In the North Texas investigation, a federal magistrate judge issued an October 9 order directing Google to provide records for 11 accounts within 10 days. Investigators identified the accounts as tools North Korean workers allegedly used to obtain employment fraudulently.
The order seeks available subscriber details, connection records, IP addresses and payment information through October 8. It excludes the contents of communications.
The Dallas Express previously covered Treasury sanctions against a North Korean IT fraud network in August 2025. Those sanctions targeted facilitators and companies accused of supporting the regime’s revenue operations.
The FBI’s new warning urges employers to verify identities through multiple checks and watch for unauthorized remote access. It also cautions Americans against accepting payment to share personal information, interview for someone else or host work laptops.
The North Texas investigation continues, prosecutors said. Companies and individuals with information can report it through the FBI’s Internet Crime Complaint Center.
Provided by Dallas Express
