FBI Seizes 187 Laptops in Texas Raid Targeting DPRK IT Worker Scheme

FBI operation disrupts DPRK laptop farms in Texas

On a recent Tuesday, federal law enforcement agents executed coordinated raids in Texas that resulted in the seizure of almost two hundred laptops. The devices were part of a covert network used by the North Korean state‑run cyber group known as Famous Chollima. The operation marked a significant blow to a long‑standing scheme that employed U.S. citizens to perform low‑level hacking tasks for Pyongyang.

Background on the Famous Chollima group

Famous Chollima has been identified by the U.S. Department of Justice as a prolific actor behind ransomware, data theft, and cryptocurrency fraud. The group typically outsources simple tasks—such as credential stuffing, phishing, and proxy services—to remote workers who are recruited through online job boards. These workers are often unaware that their activities support a sanctioned foreign regime.

How the laptop farms operated

Participants received a laptop pre‑installed with custom software that routed traffic through North Korean servers. The laptops were shipped to various U.S. locations, where they were kept in private homes, dormitories, or shared office spaces. Workers logged in daily, performed assigned commands, and uploaded results to encrypted drop sites. Payments were made in cash or cryptocurrency, making the financial trail difficult to follow.

• Each laptop was configured with a virtual private network that masked its origin.
• Software allowed the remote operator to issue new tasks without physical access.
• Compromised devices were periodically swapped to avoid detection.

Details of the raid and arrests

Federal agents from the FBI, in partnership with the Department of Justice, seized 186 laptops and one tablet from three residential addresses in the Dallas‑Fort Worth area. Two U.S. nationals were taken into custody at the scene. In addition, fourteen individuals have been formally charged with conspiracy to commit computer fraud and identity theft.

Seizure of equipment

The confiscated hardware included:

1. 186 laptops ranging from consumer models to high‑performance machines.
2. One tablet used for command‑and‑control communication.
3. External hard drives containing logs and stolen data.
4. Multiple SIM cards linked to the network’s proxy servers.

Forensic analysis is ongoing, but early reports indicate that the devices were used to harvest personal information from victims in the United States and Europe.

Charges against U.S. nationals

The indictment alleges that the arrested individuals knowingly provided services to a foreign intelligence entity. Penalties under the Computer Fraud and Abuse Act can reach up to 20 years in prison per count, plus substantial fines. The government also seeks asset forfeiture for any proceeds derived from the illicit activity.

Implications for U.S. cybersecurity

The raid underscores the growing threat posed by state‑sponsored cyber groups that outsource low‑level work to unwitting citizens. By targeting the infrastructure rather than just the operators, law enforcement aims to dismantle the supply chain that fuels larger attacks.

Threat to critical infrastructure

Experts from the Cybersecurity and Infrastructure Security Agency warn that similar laptop farms could be repurposed to target utilities, healthcare systems, and supply‑chain networks. The ability to infiltrate a system with a legitimate‑looking device makes detection especially challenging.

According to a recent CISA advisory, North Korean actors have increased their focus on ransomware as a revenue source. The seizure of these laptops may reduce the pool of available tools for future ransomware campaigns.

Response from law enforcement agencies

FBI Director Christopher Wray emphasized the importance of public‑private cooperation. He urged technology companies to report suspicious bulk purchases of hardware and to assist with device fingerprinting. The Department of Justice also announced a new outreach program aimed at educating potential remote workers about the legal risks of participating in foreign cyber operations.

International reaction and future outlook

South Korean officials praised the operation as a deterrent against Pyongyang’s illicit cyber activities. The United Nations Office on Drugs and Crime, which monitors transnational crime, highlighted the case as an example of how criminal networks exploit global supply chains.

Analysts predict that North Korean cyber groups will adapt by using more decentralized methods, such as cloud‑based containers that do not require physical laptops. Continuous monitoring of hardware shipments and tighter verification of remote work contracts are expected to become standard practice for U.S. agencies.

While the immediate impact of the raid is clear, the long‑term effectiveness will depend on the ability of investigators to trace the remaining components of the network and to prevent reconstitution of similar operations. The case serves as a reminder that cyber threats often begin with ordinary devices placed in ordinary homes.