Secure Remote Workflows After FBI Seizes 187 Devices in Texas Raids

The US Department of Justice announced coordinated enforcement actions this week against a North Korean scheme designed to place fake IT workers inside American companies, according to Security Affairs. Two US nationals were arrested, and 14 people faced charges across two separate indictments linked to the operation.

The risk

The FBI executed searches at more than 40 residences in Texas between September 21 and 25 as part of Operation Lonestar Roundup. Investigators seized approximately 187 computer devices, including laptops and KVM switch units. These devices were originally shipped by American employers to remote employees they believed were legitimate hires.

The operation relied on North Korean intelligence agents using stolen US identities to apply for remote technology positions. According to Security Affairs, these workers used virtual private networks and proxy servers to mask their location, making it appear they were working from within the United States.

Who is exposed

An indictment from the Northern District of Ohio states the scheme operated from 2019 to mid-2025. It targeted more than 70 US companies across 17 states. The affected organizations operated in sectors including healthcare, communications, cybersecurity support, retail, and manufacturing.

American helpers received the laptops provided by employers and installed remote access software to allow North Korean workers to use the machines. These helpers were paid for their role in facilitating the remote access, while the earnings were routed elsewhere.

Cost and compliance

The Department of Justice states the scheme impacted more than 70 US company employers and generated approximately $3 million in revenue for the IT workers. This revenue is believed to have been sent to sanctioned entities controlled by the Democratic People’s Republic of North Korea.

Our take on the response

Managers should audit all remote access logs for anomalies in geolocation or device fingerprints. Verify that hardware serial numbers match employee records before granting network access. Treat any discrepancy between identity documents and technical telemetry as a high-priority incident requiring immediate isolation.

What defenders should look for

Teams usually detect this type of infiltration by monitoring for remote access software installations on corporate-issued hardware. Check whether login locations conflict with known employee residences or shift patterns. Look for unusual data exfiltration volumes or connections to unknown proxy servers. Isolate suspect devices immediately to prevent lateral movement. Review user behavior analytics for deviations from standard work hours or tool usage. Validate identity credentials against internal records regularly to catch mismatches early.

What to do and how to stay safe: North Korea

• Verify the physical location of all remote employees using IP geolocation and device telemetry.
• Audit remote access software installations on all company-issued laptops for unauthorized tools.
• Review payroll and identity records for discrepancies between hire dates and system access logs.
• Monitor network traffic for connections to known proxy services or virtual private networks.

Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many devices did the FBI seize in Texas?

The FBI seized approximately 187 computer devices, including laptops and KVM switches, during the raids.

Which sectors were targeted by the North Korean scheme?

The scheme targeted companies in healthcare, communications, cybersecurity support, retail, and manufacturing.

How much revenue did the scheme generate?

The scheme generated approximately $3 million in revenue for the IT workers involved.