DPRK Laptop Farms Target 70 US Firms: Windows Endpoint Defense Against KVM Remote Workers

Tracked by cybersecurity vendor CrowdStrike under the moniker Famous Chollima, the operation highlights one of the most persistentinsider-threat and endpoint-security headaches facing modern enterprise administrators. Instead of breaching a corporate perimeter with a zero-day exploit, operatives associated with the Democratic People’s Republic of Korea (DPRK) simply apply for a job, ask HR to mail the company laptop to a domestic facilitator's house, and log right in using valid corporate credentials.

While the scheme detailed in the latest federal indictment generated a relatively modest $3 million in illicit wages, the operational footprint—spanning more than 40 raided residences in Texas and 187 seized devices—underscores just how industrialized physical proxy hosting has become.

Inside Operation Lonestar Roundup and the Federal Indictment​

The Justice Department’s announcement encompasses two connected enforcement tracks: a massive physical disruption campaign in Texas and an unsealed federal indictment out of Ohio.

Between September 21 and September 25, 2026, FBI agents executed Operation Lonestar Roundup, conducting searches and law enforcement actions across more than 40 residences in Texas suspected of operating as laptop farms for DPRK IT workers. Over the course of the operation, federal agents seized approximately 187 computer devices and hardware keyboard, video, and mouse (KVM) switches used to give overseas workers remote physical control over corporate machines.

Alongside the Texas raids, prosecutors unsealed an indictment Charging 14 individuals in connection with the multi-year conspiracy. Two U.S. citizens were arrested as part of the sweep:

• Michael James Bostelle of Pennsylvania
• Juan Cecilio Pena Carillo of Texas

Both men are accused of hosting employer-issued laptops on behalf of overseas operatives, configuring remote-access software on the machines, and laundering the resulting IT salaries into accounts controlled by North Korean actors. They face four counts involving wire fraud, money laundering, and identity theft. As with any federal indictment, the charges are formal allegations, and the defendants are presumed innocent unless and until proven guilty in court.

The effects of the scheme rippled across critical verticals. According to iTnews and DOJ disclosures, the fraudulent workers infiltrated roughly 70 U.S. employers across the healthcare, communications, retail, manufacturing, and cyber-support sectors.

Summary: Key Enforcement Metrics​

How a "Laptop Farm" Defeats Traditional Endpoint Security​

Why go through the trouble of recruiting Americans to stack corporate laptops on wire racks in Texas bedrooms? For Windows administrators and security operations center (SOC) analysts, the answer comes down to how modern identity and device trust are evaluated.

If an employee is hired for a U.S.-based remote software engineering role, logging into Microsoft Entra ID or a corporate VPN from an IP address in China or Russia will immediately trip conditional access policies and impossible-travel alerts. Even if the operative routes traffic through a commercial VPN or residential proxy, an enterprise Endpoint Detection and Response (EDR) agent running directly on the corporate laptop can still inspect local Wi-Fi BSSIDs, system locale settings, time zones, and hardware telemetry.

Laptop farms bypass these geolocation checks by keeping the physical corporate endpoint inside the United States:

1. Identity Fabrication: Operatives use stolen or borrowed identities of real U.S. citizens to pass initial HR screening and employment verification.
2. Logistics Manipulation: Once hired, the operative needs the company-issued laptop delivered to the facilitator's residence rather than the address on the stolen ID. According to CrowdStrike, Famous Chollima operatives have gone to extreme lengths to reroute hardware—including filing fraudulent police reports claiming an initial laptop was stolen so HR would ship a replacement to a "temporary" address, or claiming a sudden, last-minute relocation while a package is already in transit.
3. The Hardware Bridge: Once the facilitator receives the box, they unbox the corporate laptop, plug it into home internet, and install unauthorized remote access tools—or attach an external KVM-over-IP device.

That KVM detail is particularly vital for systems administrators to understand. If a facilitator installs commercial remote desktop software directly onto the Windows OS, a well-tuned EDR platform or application-allowlisting policy (such as Windows Defender Application Control or AppLocker) can spot the unauthorized binary. However, an external hardware KVM plugs into the laptop's video output (HDMI/DisplayPort) and USB ports. To the Windows operating system, the KVM simply looks like a standard monitor, keyboard, and mouse. The overseas operative connects to the KVM over the internet, seeing the screen and typing commands without leaving a software footprint on the host OS.

Furthermore, as noted in reporting from News Directory 3 citing the Justice Department's Tuesday announcement, DPRK operatives are adapting to improved private-sector detection by asking U.S. facilitators to take on a wider array of duties, and occasionally subcontracting entire job assignments out to third-party foreign nationals.

Actionable Guidance: Hardening Windows Environments Against Laptop Farms​

CrowdStrike warned in its assessment of the takedown that while law enforcement disruptions are critical, they are unlikely to create permanent effects on their own, noting that the adversary will almost certainly continue evolving its methods to evade discovery. Because you cannot rely solely on law enforcement to unplug every illicit rack of laptops, IT and security teams must tighten the link between HR onboarding, physical logistics, and endpoint telemetry.

Here is how enterprise administrators can hunt for and prevent hardware-hosted remote worker fraud:

1. Audit USB and Display Hardware Telemetry​

Because sophisticated laptop farms rely on external KVM switches or USB-over-IP dongles to avoid triggering software alerts, defenders should look closely at peripheral device logs.

• Check Device Installation Events: Use your EDR platform (such as Microsoft Defender for Endpoint) or Windows Event Logs to query for unusual plug-and-play device IDs. Look for generic video capture cards, HDMI dummy plugs, or known IP-KVM vendor IDs (such as Pikvm, TinyPilot, or commercial Raritan/Aten hardware) attached to standard developer laptops.
• Enforce USB Device Control: Where feasible, use Group Policy or Microsoft Intune device installation restrictions to block unauthorized USB device classes, or generate high-severity alerts when non-standard composite USB human interface devices (HID) are connected alongside persistent video-out connections on a closed-lid laptop.

2. Lock Down Remote Administration Software​

Not every facilitator uses a hardware KVM; prosecutors noted that the defendants in this case also installed remote access software directly onto victim laptops.

• Block Unsanctioned RMM Tools: Maintain strict application control policies blocking consumer and third-party Remote Monitoring and Management (RMM) binaries, portable executables, and reverse-tunneling utilities (e.g., AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, ngrok) unless explicitly required and scoped to specific admin groups.
• Require Admin Approval for Network Adapters: Prevent standard users from installing virtual network adapters or VPN clients on corporate endpoints.

3. Close the HR-to-IT Logistics Gap​

Technical controls fail when the supply chain is compromised before the laptop is even powered on.

• Flag Address Mismatches: Establish a hard policy between HR, IT asset management, and shipping providers: a corporate laptop must only be shipped to the verified residential address listed on the employee’s background check and tax documentation.
• Block In-Transit Rerouting: Configure corporate shipping accounts (FedEx, UPS) to prohibit recipients from redirecting packages to alternate addresses or retail pickup lockers while in transit.
• Treat "Stolen on Arrival" Claims as Security Incidents: Taking a cue from CrowdStrike's observation about fake police reports, any newly onboarded remote worker who claims their initial laptop was lost or stolen in transit—and immediately requests a replacement shipped to a different state or address—should trigger an immediate security review and live video identity re-verification before a second device is provisioned.

4. Enforce Phishing-Resistant, Biometric MFA​

When an operative sits thousands of miles away from the physical laptop, passing a prompt that requires physical presence becomes a major friction point. Implementing Windows Hello for Business backed by the laptop's local Trusted Platform Module (TPM) or requiring FIDO2 hardware security keys with biometric verification forces the person sitting in front of the hardware to authenticate. While a facilitator can still tap a key on command, frequent biometric challenges tied to privileged actions significantly degrade the operational speed of a remote laptop farm.

The Bottom Line for Enterprise IT​

Operation Lonestar Roundup is a major tactical win for the FBI, yanking nearly 200 compromised endpoints off corporate networks and exposing the domestic facilitators who make North Korea's remote-work sanctions evasion possible. Yet the underlying lesson for Windows administrators is sobering: your most dangerous insider threat might not be a disgruntled employee, and your toughest breach might not involve malware. Sometimes, the attacker is simply clocking in at 9:00 AM through a USB capture card in a Texas suburb.