North Korean IT Workers Used Stolen US Identities to Earn $3 Million

Federal law enforcement has initiated substantial actions against North Korea’s long-standing operation to integrate fake IT workers into American companies for regime funding. The coordinated effort, dubbed Operation Lonestar Roundup in Texas, involved arrests and the seizure of nearly 187 devices from suspected "laptop farms." The scheme reportedly ran from 2019 until mid-2025, targeting over 70 U.S. employers across multiple states in sectors like healthcare and manufacturing. North Korean workers operated using stolen identities, masking their locations via VPNs while earning approximately $3 million, which authorities believe was channeled to sanctioned DPRK entities.
The operation highlights an evolving threat landscape; adversaries are reportedly counteracting detection by actively recruiting U.S. facilitators and subcontracting tasks abroad, complicating attribution. Authorities warn that thousands of such state-controlled workers remain embedded in Western businesses as a significant insider threat, with individual annual earnings potentially reaching $300,000. This enforcement round is part of the Justice Department’s ongoing initiative targeting domestic enablers supporting DPRK revenue generation.

Two U.S. nationals were arrested; 14 people face charges across two indictments.
The FBI searched over 40 residences in Texas during Operation Lonestar Roundup (September 21–25).
Approximately 187 laptops and KVM switch devices were seized in the Texas operation.
The scheme targeted more than 70 U.S. companies across 17 states, including sectors like healthcare and communications.
The fraudulent activity reportedly occurred between 2019 and mid-2025.
North Korean IT workers allegedly generated approximately $3 million in revenue for their activities.
Victim employers were located in Ohio and sixteen other states, plus the District of Columbia.
North Korean hackers are noted by CrowdStrike to be responsible for about half of documented hands-on cyber intrusions over the past year.
The DOJ released specific email addresses used in these operations for company screening purposes.

<STEELMAN>
The strongest interpretation presents this as a highly successful counter-intelligence operation, leveraging sophisticated domestic collaboration—such as cooperation with private entities like CrowdStrike—to dismantle a complex economic and intelligence infrastructure operated by the DPRK. The scale of impact ($3 million generated across 70+ companies) suggests that this was not merely opportunistic fraud but a deliberate, state-supported revenue stream integrated directly into Western commercial ecosystems, posing a profound threat to intellectual property and national security through embedded actors.
</STEELMAN>
<PATTERNSCAN>
Patterns detected: none
</PATTERNSCAN>
The underlying paradigm driving this narrative is the persistent tension between globalized economic interconnectivity and the state-sponsored calculus of illicit resource acquisition. The assumption that remote, digitized labor allows for geographically untraceable extraction is being challenged by law enforcement's focus on the enabling layer—the "laptop farm" infrastructure and local U.S. facilitators. This echoes historical patterns where transnational criminal networks adapt operational methodology in response to targeted regulatory pressure, shifting from purely decentralized crime to more structured, hybridized corporate intrusion models.