Feds called it Operation Lonestar Justice, and the stock photo is a rodeo. Cute. The actual scene is a suburban Texas room stacked with corporate laptops, each one a US-looking front for hands that never sat in that zip code. That is the North Korean IT-worker play, and it still walks through cybersecurity programs that treat a domestic IP and a clean video interview as proof of a person.

You shipped the hardware to a US address. HR liked the GitHub. The VPN came from Texas. Payroll cleared. Somewhere in that chain, everyone assumed the laptop and the engineer were the same object. They are not.

The closet is the infrastructure

Laptop farms are a logistics business. A facilitator in the United States takes delivery of the machine you issued to “your contractor,” docks it in a spare room or a rented suite, and leaves remote-control software running so an operator overseas can work the ticket queue. Your org sees an onshore hire. Your SOC sees a residential American ISP. The operator sees your repos, your cloud consoles, and the Slack thread where someone pasted a one-time code because the “new guy” was stuck in MFA.

There is no clever exploit in the middle of that path. There is a staffing and shipping workflow with a hostile human at the far end of a KVM. The Justice Department has been charging the pattern for years: purchased or stolen US identities, mule accounts for wages, the occasional implant dropped into a customer environment, and paychecks that violate sanctions because they fund the wrong government. Dark Reading’s leftover-news hit on Operation Lonestar Justice is about the stateside layer of that machine, the Texas rooms that make the traffic look local.

You can seize the closet. You still have to explain how your laptops got there.

Remote work made this easy, and you paid for that convenience on purpose. Badge readers went away. Hardware shipping became day one. A 40-minute video call became the identity proof. That stack is an authentication protocol. It is weaker than the SSO you argue about in architecture reviews, and it sits under every privileged contractor you have not walked into a room.

The farm operator does not need to brute-force your VPN. They have the password, the token, and a blessed laptop sitting on a dock in a friendly jurisdiction. Your threat-protection stack is waiting for malware callbacks and spray-and-pray. This looks like employment.

Your firewall is applauding a residential IP

Look at the packet. It is boring. That is the point.

Defense in depth on the slide deck includes a firewall, a VPN, a geo rule, and a license that promised threat detection. Those tools earn their keep against noisy brute-force and obvious foreign C2. A farm session fails every one of those stories. Successful auth. Managed device. US source IP. User-agent that matches the image you shipped. Session length that looks like a workday if you do not ask why this person never comes on camera.

ipban belongs in that stack for the credential-stuffing garbage on the VPN. Keep it. A Texas residential IP with a valid MFA prompt will never hit it. If you run IPBan Pro, you already know it is for repeat offenders, not for a contractor who logs in once in the morning and rides the jump host until dinner.

The parallel failure sits in HR and procurement. A video call with a stand-in. An SSN that belongs to a real person who does not work for you. A resume that has been through three companies this year under two other names. Pay routed to an account that does not match the offer letter. Cyber security questionnaires asked about SOC 2. Nobody owned the question “who is in the room with that laptop, and how do we know.”

Standups without cameras. Copy-paste lag that people joke about as “their internet.” A developer who cannot meet in person even when the rest of the team is in town. Timezone math that only works if you squint. Those are hunts. Most teams still file them under culture.

Hunt the farm before you hunt the country

Stop waiting for a country-code alert. The country code is Texas.

Do the immediate work on the fleet you already manage. Pull endpoint geolocation for contractor and fully remote laptops and look for devices that never move. A machine that has sat on the same Wi-Fi for 90 days while the resume said Austin, then Dallas, then “traveling” is a farm candidate. So is a device with a KVM, a pile of USB docks, or remote-control software you did not install. Freeze first, argue later. A real engineer can prove they are in the room. A closet cannot.

Run the identity side the same week. Compare payroll names to bank-account names. Look for the same persona, phone, or device fingerprint across vendors. Require a live, unscheduled camera check for anyone with production or source access; the people in the closet hate surprise video. Ask MDM for recovery contacts and see what bounces. If the “employee” cannot complete a same-day hardware challenge, the account is done until a human shows up with the chassis.

Watch the boring telemetry. Endpoints that never change BSSID, GPS, or public IP while the human claims mobility. Persistent AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, or mystery RDP listeners on imaged laptops. Login hours that cluster on Pyongyang or Beijing workdays for “US-only” contractors. Multiple corporate identities exiting one residential IP or one shipping address. Interview faces, tax IDs, and payees that do not describe the same person twice.

Ongoing controls are chain of custody, not another dashboard. Privileged remote roles get in-person or notary laptop issuance, or they do not get privileged roles. Remote-control binaries become high-severity detections, not “approved for support.” Every privileged identity, human or service, needs a named owner who can be fired. Put a laptop-farm scenario into incident response: freeze the identity, seize or wipe the endpoint, preserve payroll and shipping records, and loop in legal on sanctions exposure. Security hardening here is unglamorous on purpose. You are proving that the hands on the keyboard live with the serial number you issued.

If cybersecurity can’t name the human, revoke the access

There is a cousin of this problem running on laptops you do know. Unowned AI agents holding API keys, database passwords, and internal reach, with nobody reviewing the access. Same bug. A privileged identity with no accountable person. The farm hides a human you would never hire. The agent hides the fact that you hired no one at all.

The real problem here is that you keep scoring location, tooling, and productivity narratives instead of custody. A US IP is not a person. A clean interview is not a person. A helpful agent with a config file full of secrets is not a person. If you cannot name the human who is on the hook for a credential, revoke it until someone claims it in a way you can fire them for.

Production does not care that the story was contracting, or remote-first, or “the vendor already screened them.” Your job is to make access expensive for anyone who will not sit in the camera frame, hold up the asset tag, and say their real name.

Sources

• What We Missed: Feds Lasso Texas Laptop Farms
• The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat