FBI Raids Texas Homes in North Korean IT Identity Fraud Scheme

The US Department of Justice announced coordinated enforcement actions this week against a North Korean scheme that placed fake IT workers inside American companies. The Justice Department stated these actions target the Democratic People’s Republic of North Korea government’s efforts to fund its regime through remote information technology work for US firms.

Federal Bureau of Investigation agents searched more than 40 residences in Texas between September 21 and 25 as part of Operation Lonestar Roundup. Investigators seized approximately 187 computer devices, including laptops and KVM switches, which were originally shipped by American employers to their newly hired remote employees.

Context and Background

The operation targeted a long-running fraud scheme that ran from 2019 to mid-2025, according to an indictment from the Northern District of Ohio. North Korean intelligence agents applied for remote jobs using stolen or fake US identities to bypass hiring verification processes. They utilized virtual private networks and proxy servers to mask their true location, making it appear as though they were working from within the United States.

American helpers played a critical role in facilitating this deception by receiving the employer-provided laptops and installing remote access software. These helpers were paid for their assistance, while the revenue generated from the IT jobs was transferred to accounts controlled by the North Korean regime. The seized devices were the same machines used by the DPRK workers to perform their duties.

Who Is Affected

The scheme impacted more than 70 US companies across 17 states, targeting sectors such as healthcare, communications, cybersecurity support, retail, and manufacturing. The Justice Department reported that the operation generated approximately $3 million in revenue for the IT workers, which is believed to have been sent to sanctioned entities controlled by the DPRK.

Two US nationals were arrested during the operation, and 14 people were charged across two separate indictments. The arrests and charges represent a significant enforcement action against the infrastructure supporting these fraudulent employment arrangements.

As Threat Times reported on October 16, 2026, threat actor TAG-217 prepared infrastructure weeks before public disclosure of attacks on South Korean financial institutions, highlighting the persistent nature of North Korean cyber operations.

What should you do?

The Justice Department’s announcement confirms that the US government is actively prosecuting individuals who facilitate North Korean IT fraud. Organizations should review their remote hiring verification processes to ensure they are not inadvertently employing individuals using stolen identities. The seizure of 187 devices suggests that compromised hardware may still be in circulation or that similar setups exist elsewhere.

Background: Proxy servers

Proxy servers are not inherently safe. They mask your IP address but expose your traffic to the proxy operator. Safety depends entirely on whether you trust that operator and whether the proxy supports end-to-end encryption. Without proper configuration, proxies often leak data or become targets for man-in-the-middle attacks.

Read the full guide: Are Proxy Servers Safe? The Hidden Risks and Configuration Rules

What to do and how to stay safe: FBI

• Verify the physical location of remote employees using independent geolocation checks rather than relying solely on self-reported IP addresses.
• Require video interviews with clear background verification to confirm the identity of remote IT hires before issuing company equipment.
• Monitor for unusual network behavior on remote devices, such as connections to known proxy services or inconsistent access patterns.
• Review vendor contracts and employment agreements to include strict clauses prohibiting the use of intermediaries or third-party hardware handlers.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much money did the North Korean IT scheme generate?

The scheme generated approximately $3 million in revenue for IT workers, which was sent to sanctioned entities controlled by the DPRK.

How many people were charged in this operation?

Fourteen people were charged across two separate indictments, and two US nationals were arrested.

What devices were seized by the FBI?

The FBI seized approximately 187 computer devices, including laptops and KVM switches, from more than 40 Texas residences.