U.S. authorities have charged 14 people and seized approximately 187 laptops and other devices in a coordinated crackdown on a North Korean remote IT worker operation that allegedly infiltrated more than 70 American companies. The Justice Department said the actions included two arrests, searches at more than 40 suspected “laptop farms” in Texas and an indictment charging wire fraud, money laundering and identity theft. The department said the operation generated about $3 million for entities controlled by North Korea.
The indictment, unsealed in the Northern District of Ohio, names U.S. citizens Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, along with 10 China-based defendants and two people whose identities remain sealed. Prosecutors allege that the group obtained remote jobs between 2019 and July 2025 by using stolen or fabricated identities, virtual private networks and proxy infrastructure to make North Korean workers appear to be U.S.-based employees. The affected employers spanned health care, communications, cyber support, retail and manufacturing, according to the Ohio U.S. attorney’s office.
The Texas searches, conducted from Sept. 21 through Sept. 25 under Operation Lonestar Roundup, targeted residences where facilitators allegedly received and maintained employer-issued computers. These “laptop farms” allowed overseas workers to connect remotely to company systems from devices physically located in the United States. The FBI said the seized equipment included laptops and keyboard-video-mouse devices. Bostelle allegedly supplied his identity and a fraudulent driver’s license to help a worker secure employment, while Carrillo allegedly hosted laptops and received roughly $190,000 from five employers. Another alleged facilitator, Trey Michael Nolte, is identified in the indictment but was not charged.
The scheme illustrates why the threat extends beyond payroll fraud. North Korean workers and their facilitators can obtain access to corporate networks, proprietary information and sensitive data while passing ordinary remote-work checks. The FBI’s public guidance says operators increasingly recruit U.S. residents to appear in interviews, complete screening requirements, access accounts and keep company devices online. Some workers also subcontract assignments to third-country freelancers, while investigators have reported data theft, extortion and threats against former employers.
U.S. officials and CrowdStrike identify the broader activity involving the workers and their helpers as Famous Chollima. The DOJ said the group relies on fraudulent email, job-site and social-media accounts, false identity documents, proxy computers and remote-access software to defeat location and identity checks. Employers should therefore treat hiring verification as an ongoing security control rather than a one-time onboarding step: validate identity and work history independently, examine anomalous device and network telemetry, restrict access for new accounts and monitor unusual data transfers. The defendants are presumed innocent unless proven guilty, and the State Department’s Rewards for Justice program offers up to $5 million for information disrupting North Korean illicit financial activity.
