Skip to main content
AVOID.NET
← avoid.net

Verify a decision

Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.

How verification works

  1. We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction.
  2. We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
  3. You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>

Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.

Sequence
#1
Score
→
Cluster
mainnet-beta
Slot
457814605
Off-chain at
2026-10-16T23:06:53.621Z
Anchored at
2026-10-16T23:07:10.614Z
Block time
—

Independent verification

1. Database (off-chain)
Gj1wFGXuRP27zFqB3eK5tydK4EvznrdR5UD4fSwM9fkN
2. Recomputed (your browser)
computing…
3. On-chain (Solana memo)
fetching…
Canonical bytes hashed (25722 chars)
{"actor":"system:backfill","investigation_id":"c8fbfd32-59e0-4ede-801c-c2e3d463ee05","kind":"publish","page_slug":"dprk-it-worker-laptop-farm-network-operation-lonestar-roundup","published_at":"2026-10-16T23:06:53.439Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DPRK IT Worker Laptop Farm Network (Operation Lonestar Roundup)","sections":[{"content":"On October 13-15 2026, the U.S. Department of Justice announced coordinated enforcement actions under the banner of Operation Lonestar Roundup, charging 14 individuals in connection with a scheme to place North Korean remote IT workers inside U.S. companies using fraudulent identities. Two U.S. nationals were arrested: Michael James Bostelle, 31, of Philadelphia, Pennsylvania, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. Ten Chinese nationals — Sun Sheng Ming (Dandong City), Pei Li Guang (Liaoning), Weng Shou Cheng (Liaoning), Han Guo Bin (Dandong City), Wang Jian Jun (Dandong City), Sheng Zhang Kun (Shenzhen), Zhang Wei Ping (Dandong City), Zhang Li Ping, Yu Yang (Dandong City), and Jin Long — were charged but remain at large. Two additional defendants were charged under sealed identities. Charges include wire fraud conspiracy, money laundering conspiracy, identity theft conspiracy, and aggravated identity theft. A separate Northern District of Georgia indictment, unsealed July 1 2025, charged four North Korean nationals — Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il — with five counts of wire fraud and money laundering related to approximately $900,000 in cryptocurrency allegedly stolen from two employer companies; all four remain at large. Trey Michael Nolte of Ohio is named as an unindicted co-conspirator alleged to have managed a shell company and coordinated cryptocurrency transfers to defendant Sun Sheng Ming. All charges represent accusations at the indictment stage; no convictions have been entered as of the date of this writing.","heading":"Law Enforcement Action and Charges","severity":"critical","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Actions Against North Korean Remote IT Workers (2026)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":1,"name":"DOJ Northern District of Texas — Operation Lonestar Roundup Press Release","type":"regulatory","url":"https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us"},{"credibility":2,"name":"6abc Philadelphia — DOJ Charges North Koreans Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, Chang Nam Il","type":"news_article","url":"https://6abc.com/post/doj-charges-north-koreans-kim-kwang-jin-kang-tae-bok-jong-pong-ju-chang-nam-il-stealing-us-money/16892834/"},{"credibility":2,"name":"Cybersecurity Dive — Feds Crack Down on North Korean IT-Worker Schemes","type":"news_article","url":"https://www.cybersecuritydive.com/news/north-korea-it-worker-raids-arrests-charges/832968/"}]},{"content":"Between September 21 and September 25 2026, FBI agents executed search warrants at more than 40 residences across Texas that were known or suspected to be operating as laptop farms for DPRK IT workers. The raids seized approximately 187 laptops and keyboard-video-mouse (KVM) switch devices. Laptop farms are residential setups in which U.S.-based facilitators receive employer-issued computers, install remote-access software or KVM hardware, and allow overseas operatives to control the devices — creating the appearance of a domestic employee while the actual operator is abroad. According to prosecutors, facilitators also filed false police reports claiming device theft in order to obtain replacement hardware, and in some instances claimed sudden relocations to avoid in-person verification. The geographic concentration of farms in Texas reflects the broader 'DPRK RevGen: Domestic Enabler Initiative' that FBI analysts have documented across multiple enforcement cycles dating to at least 2022.","heading":"Laptop Farm Infrastructure and Physical Raids","severity":"critical","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Actions Against North Korean Remote IT Workers (2026)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":2,"name":"The Hacker News — U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud","type":"news_article","url":"https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html"},{"credibility":2,"name":"Nextgov/FCW — FBI Disrupts North Korean Laptop Farm Used to Infiltrate US Companies","type":"news_article","url":"https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/"}]},{"content":"According to the indictment, the scheme operated from approximately 2019 through July 2025 and penetrated more than 70 U.S. companies across at least 17 states and Washington D.C. Target sectors included healthcare, communications, cybersecurity support, retail, manufacturing, aerospace, energy, financial services, defense engineering, and government technology. North Korean operatives obtained remote employment using stolen, rented, or fabricated identities — in at least one documented instance posing as 'Bryan Cho,' a fictional Malaysian IT contractor. Workers then used VPNs, proxy infrastructure, and laptop farm hardware to appear domestically located while operating from abroad. The indictment alleges that the identities of more than 25 U.S. persons were compromised, and that false information was conveyed to the Department of Homeland Security, the IRS, and the Social Security Administration on dozens of occasions. In the Georgia-indicted cases, Kim Kwang Jin and Jong Pong Ju are alleged to have modified smart contract source code on Ethereum and Polygon blockchains to alter withdrawal rules governing employer funding pools, enabling direct theft of approximately $175,000 and $740,000 respectively. Once inside company networks, operatives also allegedly exfiltrated sensitive data in some cases, including information controlled under International Traffic in Arms Regulations (ITAR). Prosecutors allege that some operatives made death threats against former managers and their families when confronted about their identities.","heading":"Scheme Mechanics and Corporate Infiltration","severity":"critical","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Nationwide Actions (July 2025 iteration)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"credibility":2,"name":"VOA News — DOJ Charges 14 in North Korean IT Worker Scheme","type":"news_article","url":"https://www.voanews.com/a/doj-charges-14-in-north-korean-it-worker-scheme/8211282.html"},{"credibility":2,"name":"Vision Times — US Charges 14 in North Korea Remote IT Worker Scheme","type":"news_article","url":"https://www.visiontimes.com/2026/10/15/us-charges-14-in-north-korea-remote-it-worker-scheme-targeting-more-than-70-companies.html"},{"credibility":2,"name":"Gizmodo — FBI Raids Over 40 Texas Homes, Charges Americans in North Korean Laptop Farm Scheme","type":"news_article","url":"https://gizmodo.com/fbi-raids-over-40-texas-homes-charges-americans-in-north-korean-laptop-farm-scheme-2000825918"}]},{"content":"Prosecutors allege the scheme generated approximately $3 million in total income for overseas North Korean IT workers, with funds believed to have been sent to sanctioned entities controlled by North Korea in violation of U.S. and international sanctions. The indictment identifies cryptocurrency as one of the primary channels used to transfer funds abroad. According to court filings, unindicted co-conspirator Trey Michael Nolte allegedly maintained a spreadsheet to coordinate transfers between bank accounts and virtual currency wallets, subsequently routing funds to defendant Sun Sheng Ming. In the separate Georgia indictment, the four named North Korean nationals allegedly laundered stolen cryptocurrency — approximately $900,000 in total — through the Tornado Cash mixing service before transferring funds to accounts opened under aliases using fraudulent Malaysian identification documents. The DOJ has not publicly specified individual wallet addresses or exchange names in either the Texas or Georgia indictments. The alleged fund flows implicate violation of the International Emergency Economic Powers Act (IEEPA), executive orders prohibiting transactions with the DPRK, and UN Security Council resolutions. Prosecutors allege the revenue ultimately supported North Korea's weapons programs, including nuclear weapons development. These remain allegations; no adjudication on the merits has been entered.","heading":"Cryptocurrency Laundering and Sanctions Violations","severity":"critical","sources":[{"credibility":2,"name":"KuCoin News — US DOJ Arrests Two in Crackdown on North Korean IT Fraud Scheme","type":"news_article","url":"https://www.kucoin.com/news/flash/us-doj-arrests-two-in-crackdown-on-north-korean-it-fraud-scheme"},{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Actions Against North Korean Remote IT Workers (2026)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":2,"name":"National Law Review — DOJ Makes Progress Dismantling N. Korean IT Worker Fraud","type":"news_article","url":"https://natlawreview.com/article/doj-makes-progress-dismantling-n-korean-it-worker-fraud"}]},{"content":"The broader threat actor network behind these operations has been designated 'Famous Chollima' by cybersecurity firm CrowdStrike, and is also tracked under the internal operation codenames 'purpledelta' and 'Wagemole.' Between April 2025 and May 2026, CrowdStrike investigated more than 320 Famous Chollima incidents — approximately one per day — representing a 220 percent year-over-year increase in activity. The group is reported to have accounted for 47 percent of all state-sponsored hands-on-keyboard intrusions against U.S. technology companies in the twelve-month period ending March 2026, making it the single largest state actor in direct-access corporate infiltration by that measure. Crypto, Web3, and AI development teams are identified as principal targets, with operatives recruited through GitHub, LinkedIn, and staffing platforms. Documented technical indicators include: day-one reconnaissance using dxdiag, systeminfo, and wmic; installation of Chrome Remote Desktop; use of 2FA bypass services; AI-assisted job application tools; and infrastructure hosted on commercial VPS providers including Vultr and Gorilla Servers, routed through AstrillVPN exit nodes. In August 2026, researchers at an undisclosed security firm published findings from a controlled experiment in which they built a fake cryptocurrency startup called Ballena Azul and hired three suspected North Korean operatives, documenting reconnaissance and credential-harvesting behavior in detail. A multi-nation joint advisory issued in August 2026 warned that North Korean IT workers were using real-time deepfake technology to defeat video hiring checks.","heading":"Threat Actor Profile: Famous Chollima","severity":"high","sources":[{"credibility":2,"name":"The Hacker News — Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers","type":"research","url":"https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html"},{"credibility":2,"name":"Cybersecurity Dive — Feds Crack Down on North Korean IT-Worker Schemes","type":"news_article","url":"https://www.cybersecuritydive.com/news/north-korea-it-worker-raids-arrests-charges/832968/"},{"credibility":2,"name":"TechTimes — North Korean IT Workers Use Real-Time Deepfakes to Beat Hiring Checks","type":"news_article","url":"https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm"}]},{"content":"The DPRK IT worker threat is acutely elevated for organizations building in the cryptocurrency and Web3 space. The Georgia indictment documents a specific attack pattern in which operatives gained access to employer smart contract infrastructure, modified withdrawal logic, and directly siphoned approximately $900,000 from company token pools. CrowdStrike and the FBI have both identified crypto and Web3 development roles as primary recruitment targets, citing the dual goal of salary extraction and direct on-chain asset theft. The FBI has issued public guidance advising employers to conduct periodic identity verification beyond initial onboarding, require in-person confirmation for remote-first roles where possible, block known proxy and VPN services during device provisioning, and monitor for single accounts accessed from multiple IP addresses or geographic regions. Red flags documented in field investigations include forged identification with AI-generated images, inconsistent residency claims across documents, day-one system profiling commands, and immediate installation of remote access tools on provisioned hardware.","heading":"Risk to Crypto and Web3 Teams","severity":"high","sources":[{"credibility":2,"name":"The Hacker News — Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers","type":"research","url":"https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html"},{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Nationwide Actions (July 2025)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"credibility":2,"name":"The Hack Academy — 14 Charged Over North Korean Remote IT Worker Scheme: What the FBI Advises Employers","type":"news_article","url":"https://www.thehackacademy.com/us-charges-north-korean-it-worker-scheme.htm"}]},{"content":"Operation Lonestar Roundup is the latest in a series of escalating U.S. enforcement actions against DPRK remote IT worker infrastructure. A prior coordinated action in June-July 2025, involving the Northern District of Massachusetts, charged a separate group including U.S. nationals Zhenxing 'Danny' Wang and Kejia 'Tony' Wang (who pleaded guilty), along with eight Chinese nationals and two Taiwanese nationals. That operation involved the seizure of 29 laptop farms across 16 states, 21 fraudulent websites, and 29 financial accounts, and was documented to have affected more than 100 U.S. companies generating over $5 million in scheme revenue. Sanctions evasion via DPRK remote IT workers was first formally documented in a joint State-Treasury-FBI advisory issued in May 2022, which noted individual worker earnings of up to $300,000 per year. The Rewards for Justice Program currently offers up to $5 million for information that disrupts financial mechanisms supporting DPRK illicit activities. The October 2026 charges represent an ongoing prosecution, not a final adjudication.","heading":"Historical Context and Prior Enforcement","severity":"medium","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Nationwide Actions (July 2025)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"credibility":2,"name":"Fox 5 Atlanta — North Korean Nationals Wanted in Cryptocurrency Embezzlement Scheme; $5M Reward","type":"news_article","url":"https://www.fox5atlanta.com/news/north-korean-nationals-wanted-cryptocurrency-embezzlement-scheme-5m-reward"}]}],"sources_used":[{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Actions Against North Korean Remote IT Workers (2026)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":1,"name":"DOJ Northern District of Texas — Operation Lonestar Roundup","type":"regulatory","url":"https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us"},{"credibility":1,"name":"DOJ Office of Public Affairs — Coordinated Nationwide Actions (July 2025)","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"credibility":2,"name":"The Hacker News — U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud","type":"news_article","url":"https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html"},{"credibility":2,"name":"VOA News — DOJ Charges 14 in North Korean IT Worker Scheme","type":"news_article","url":"https://www.voanews.com/a/doj-charges-14-in-north-korean-it-worker-scheme/8211282.html"},{"credibility":2,"name":"Vision Times — US Charges 14 in North Korea Remote IT Worker Scheme","type":"news_article","url":"https://www.visiontimes.com/2026/10/15/us-charges-14-in-north-korea-remote-it-worker-scheme-targeting-more-than-70-companies.html"},{"credibility":2,"name":"KuCoin News — US DOJ Arrests Two in Crackdown on North Korean IT Fraud Scheme","type":"news_article","url":"https://www.kucoin.com/news/flash/us-doj-arrests-two-in-crackdown-on-north-korean-it-fraud-scheme"},{"credibility":2,"name":"Cybersecurity Dive — Feds Crack Down on North Korean IT-Worker Schemes","type":"news_article","url":"https://www.cybersecuritydive.com/news/north-korea-it-worker-raids-arrests-charges/832968/"},{"credibility":2,"name":"Nextgov/FCW — FBI Disrupts North Korean Laptop Farm Used to Infiltrate US Companies","type":"news_article","url":"https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/"},{"credibility":2,"name":"6abc Philadelphia — DOJ Charges North Koreans Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, Chang Nam Il","type":"news_article","url":"https://6abc.com/post/doj-charges-north-koreans-kim-kwang-jin-kang-tae-bok-jong-pong-ju-chang-nam-il-stealing-us-money/16892834/"},{"credibility":2,"name":"National Law Review — DOJ Makes Progress Dismantling N. Korean IT Worker Fraud","type":"news_article","url":"https://natlawreview.com/article/doj-makes-progress-dismantling-n-korean-it-worker-fraud"},{"credibility":2,"name":"Gizmodo — FBI Raids Over 40 Texas Homes, Charges Americans in North Korean Laptop Farm Scheme","type":"news_article","url":"https://gizmodo.com/fbi-raids-over-40-texas-homes-charges-americans-in-north-korean-laptop-farm-scheme-2000825918"},{"credibility":2,"name":"The Hacker News — Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers","type":"research","url":"https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html"},{"credibility":2,"name":"TechTimes — North Korean IT Workers Use Real-Time Deepfakes to Beat Hiring Checks","type":"news_article","url":"https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm"},{"credibility":2,"name":"Fox 5 Atlanta — North Korean Nationals Wanted in Cryptocurrency Embezzlement Scheme; $5M Reward","type":"news_article","url":"https://www.fox5atlanta.com/news/north-korean-nationals-wanted-cryptocurrency-embezzlement-scheme-5m-reward"},{"credibility":2,"name":"CBS Texas — North Texas Federal Officials Promise Indictments After Busting Alleged Laptop Farms","type":"news_article","url":"https://www.cbsnews.com/texas/news/fbi-us-attorney-press-conference-10-13-2026/"}],"summary":"Operation Lonestar Roundup is a coordinated U.S. law enforcement action, announced October 13-15 2026, dismantling a multi-year scheme in which North Korean IT workers used stolen and fabricated identities to obtain remote technology employment at more than 70 U.S. companies, generating approximately $3 million in revenue alleged to have been routed to DPRK-controlled entities in violation of international sanctions. The DOJ charged 14 individuals — two U.S. nationals arrested and ten Chinese nationals at large — for wire fraud, money laundering, and identity theft; the FBI separately dismantled over 40 residential laptop farms across Texas in raids conducted September 21-25 2026, seizing approximately 187 computers and KVM devices. The threat actor network has been designated 'Famous Chollima' by CrowdStrike and represents an active, ongoing infiltration risk particularly for crypto, Web3, and AI development teams.","timeline":[{"date":"2019-01-01","event":"Alleged scheme begins: North Korean IT workers begin obtaining remote employment at U.S. companies using stolen and fabricated identities, with U.S.- and China-based facilitators operating residential laptop farms.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2020-12-01","event":"According to the Georgia indictment, Jong Pong Ju and Kim Kwang Jin are hired as remote developers at a blockchain research company and a Serbian virtual token company, respectively.","source":"6abc Philadelphia","source_url":"https://6abc.com/post/doj-charges-north-koreans-kim-kwang-jin-kang-tae-bok-jong-pong-ju-chang-nam-il-stealing-us-money/16892834/"},{"date":"2022-02-01","event":"Jong Pong Ju allegedly modifies smart contract withdrawal logic and steals approximately $175,000 in cryptocurrency from employer token pool.","source":"DOJ Office of Public Affairs — Nationwide Actions (July 2025)","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"date":"2022-03-01","event":"Kim Kwang Jin allegedly modifies smart contract withdrawal rules and steals approximately $740,000 in cryptocurrency from employer funding pool.","source":"DOJ Office of Public Affairs — Nationwide Actions (July 2025)","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"date":"2022-05-01","event":"Joint State-Treasury-FBI advisory publicly warns of North Korean IT worker scheme for the first time, noting individual earnings of up to $300,000 per year.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2025-06-10","event":"FBI executes 29 search warrants across 16 states in a prior coordinated action, seizing 21 fraudulent websites, 29 financial accounts, and approximately 137 laptops in the Massachusetts-led investigation.","source":"DOJ Office of Public Affairs — Nationwide Actions (July 2025)","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"date":"2025-07-01","event":"DOJ unseals Georgia indictment charging Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il with wire fraud and money laundering; Massachusetts indictment against Zhenxing Wang and others announced concurrently; Kejia Wang enters guilty plea.","source":"DOJ Office of Public Affairs — Nationwide Actions (July 2025)","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote"},{"date":"2025-07-31","event":"Alleged scheme activity concludes, per the Lonestar Roundup indictment's stated operational period of 2019 through July 2025.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2026-08-02","event":"Eleven nations issue a joint advisory warning that North Korean IT workers are using real-time deepfake technology to defeat video-based hiring checks.","source":"TechTimes","source_url":"https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm"},{"date":"2026-09-21","event":"FBI begins Operation Lonestar Roundup: raids of over 40 residential laptop farms across Texas begin, spanning September 21-25 2026.","source":"DOJ Northern District of Texas","source_url":"https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us"},{"date":"2026-09-25","event":"Texas raids conclude; approximately 187 laptops and KVM devices seized from over 40 residences.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2026-10-13","event":"DOJ announces Operation Lonestar Roundup publicly; North Texas federal officials hold press conference announcing pending indictments.","source":"CBS Texas","source_url":"https://www.cbsnews.com/texas/news/fbi-us-attorney-press-conference-10-13-2026/"},{"date":"2026-10-14","event":"Federal grand jury indictment unsealed charging 14 individuals: Michael James Bostelle and Juan Cecilio Pena Carrillo arrested; 10 Chinese nationals and 2 sealed defendants charged but at large.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html"}]},"v":1}