Counterintelligence — 2026-10-16

FBI Disrupts North Korean Corporate Espionage Ring in North Texas Using Stolen Identities

BLUFDOJ is likely to bring criminal charges against at least one U.S.-based facilitator tied to Operation Lonestar Roundup by year-end, given the 187 seized devices and clear exposure for wire fraud and sanctions violations.

The U.S. Attorney's Office for the Northern District of Texas announced that FBI agents searched over 40 Texas residences under Operation Lonestar Roundup and seized 187 laptops and keyboard-video-mouse devices operated as laptop farms for North Korean IT workers 1. Roughly 100 of the devices came from north Texas 1. The DOJ release says the workers used stolen or fabricated identities and proxy infrastructure to obtain remote jobs, while U.S.-based facilitators hosted company-issued laptops and forwarded earnings to DPRK-controlled accounts 1. The release names CrowdStrike's "Famous Chollima" as the group involved and lists 11 Gmail accounts allegedly used in the scheme 12. Just the News reported that CrowdStrike assisted the operation and that the investigation into DPRK financial networks is ongoing 3.

Analysis
DOJ is likely to charge, indict, or secure a guilty plea from at least one named US-based facilitator in Operation Lonestar Roundup by December 31, 2026. Confidence is low because no complaint naming individuals is public and no charging timeline has been stated. The 187 seized devices give prosecutors physical evidence, and facilitators who housed company laptops and routed earnings to DPRK-controlled accounts face wire fraud and sanctions exposure. Sourcing is effectively one DOJ release repeated by others, so consistency does not equal independent confirmation. The operation may instead remain a seizure and victim-notification effort, with facilitators cooperating quietly or left uncharged while investigators pursue DPRK finances. If a named facilitator is charged, corporate security and HR teams will tighten identity verification and audit laptop shipments to remote hires. Absent charges, firms will treat this as a one-off and keep current vetting.

3 sources

Operation Lonestar Roundup Dismantles North Korean IT Worker Network Used to Penetrate US - U.S. Attorney's Office, Northern District of Texas (DOJ)
FBI seizes 180+ devices in Texas tied to North Korean identity theft scheme, DOJ says - KSAT
FBI disrupts North Korean corporate espionage ring in north Texas - Just the News