Justice Department Charges 14 in Alleged Scheme to Fake Remote Workers' Locations
The U.S. Department of Justice announced on Oct. 13, 2026, that it has charged 14 people in a case built on what prosecutors call "laptop farms," or U.S. homes where employer-issued laptops are kept so that remote IT workers abroad can log in and appear to be working from inside the country. The department said two U.S. nationals, one in Pennsylvania and one in Texas, were arrested.
According to the indictment, the workers applied for remote positions using stolen or fabricated identity documents and network services, including virtual private networks, that made them appear to be U.S. persons working from within the United States. Prosecutors say U.S.-based facilitators received the victim companies' laptops at their own residences, configured them and installed remote-access software. The department said the scheme reached more than 70 U.S. employers, in sectors including health care, communications, retail and manufacturing.
The release says the FBI searched more than 40 Texas residences that it describes as known or suspected laptop farms between Sept. 21 and Sept. 25, 2026. Across the operation, which the department calls Operation Lonestar Roundup, the FBI seized approximately 187 laptops and KVM devices, the keyboard, video and mouse switches that let one computer drive another.
The indictment, filed in the Northern District of Ohio, charges wire fraud, money laundering and identity theft. According to the department, the scheme ran from 2019 to around July 2025 and generated approximately $3 million in revenue that is believed to have been sent to sanctioned entities controlled by the North Korean government. Ten of those charged are described as based in China; two more remain under seal. The release states that the details in the court documents are allegations only and that all defendants are presumed innocent until proven guilty.
The FBI published a public service announcement the same day with guidance for employers on spotting the pattern, and the release lists email accounts that investigators identified, for employers to add to their own screening lists. The release says the U.S. cybersecurity firm CrowdStrike identifies this group of IT workers and their helpers as "Famous Chollima."
