The US Department of Justice announced on October 13, 2026 that 14 people had been charged in a crackdown on North Korean remote IT worker operations, including two US nationals accused of running infrastructure that allowed overseas workers to pose as employees based in the United States.
The coordinated actions included two arrests, an indictment, searches of more than 40 Texas residences known or suspected to be “laptop farms,” and the seizure of approximately 187 laptops and keyboard-video-mouse devices. The Texas searches took place between September 21 and 25 as part of Operation Lonestar Roundup.
According to the DOJ announcement, the broader operation targeted schemes intended to generate revenue for the Democratic People’s Republic of Korea through fraudulent employment at US companies.
Two US facilitators arrested, 12 other defendants charged
Authorities arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. The DOJ described them as participants in a multi-year conspiracy and said a four-count indictment filed in the Northern District of Ohio includes charges involving wire fraud, money laundering and identity theft.
The same case, Sun Sheng Ming, et al., names ten defendants based in China:
- Sun Sheng Ming
- Pei Li Guang
- Weng Shou Cheng
- Han Guo Bin
- Wang Jian Jun
- Sheng Zhang Kun
- Zhang Wei Ping
- Zhang Li Ping
- Yu Yang
- Jin Long
Two additional defendants remain under seal. Together with Bostelle and Pena Carrillo, that brings the number of charged individuals to 14.
The allegations have not been adjudicated.
How the laptop-farm system worked
The DOJ says DPRK IT personnel obtained remote jobs using stolen or fabricated identity documents. VPNs and proxy infrastructure helped them appear to be US residents working from domestic locations.
US-based facilitators allegedly received company-issued computers at their homes, creating collections of devices known as laptop farms. They configured the systems and installed remote-access software so that workers abroad could operate the computers while network traffic and physical equipment remained in the United States.
Facilitators received payment for maintaining the equipment. Revenue from the remote jobs was then transferred to accounts controlled by the DPRK, according to prosecutors.
The department says North Korean workers are recruiting more US facilitators as employers and law enforcement improve their detection methods. Their responsibilities can extend beyond hosting laptops: in some cases, facilitators perform additional operational tasks, while entire jobs may be subcontracted to other foreign nationals.
This arrangement creates risks beyond fraudulent payroll. The DOJ says DPRK IT workers have also engaged in data extortion and removed proprietary or sensitive information from US companies. A company hiring such a worker may therefore provide both revenue and authenticated access to internal systems.
More than 70 employers allegedly affected
The Ohio indictment covers conduct from 2019 through in or around July 2025. Prosecutors allege that the scheme affected more than 70 US employers and produced approximately $3 million in revenue for IT workers. The government believes the funds were sent to sanctioned entities controlled by the DPRK.
The affected employers operated in health care, communications, cyber support, retail and manufacturing. They were located in Ohio, 16 other states and the District of Columbia.
Those figures describe company employers, not a count of individual identity-theft victims or compromised accounts.
The DOJ says CrowdStrike assisted the FBI and identified the group involved as Famous Chollima. CrowdStrike has stated that the laptop infrastructure enabled its operators to impersonate legitimate workers, redirect wages and retain access to victim organizations. That description is the company’s assessment of the activity.
Operation Lonestar Roundup was coordinated by the US Attorney’s Office for the Northern District of Texas, the FBI Dallas Field Office and the FBI Cyber Division, with assistance from the Northern District of Ohio. The FBI Cleveland Field Office investigated the Ohio case.
Email accounts employers should add to screening
The DOJ said investigators identified a network of email accounts allegedly used by the operatives. It urged employers to include the following addresses in their screening indicators:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
A match should be treated as an indicator requiring review rather than, by itself, proof that an applicant or employee is connected to the operation.
The FBI also published a Public Service Announcement on October 13, 2026 containing mitigation guidance for US companies. SecurityAffairs’ account identifies several warning signs attributed to that guidance: conflicting employment histories, reluctance to appear on video, requests to redirect delivery of corporate laptops, and payment accounts routed through intermediaries.
For employers, the immediate response is to incorporate the listed accounts and behavioral indicators into recruitment checks, while scrutinizing requests that separate the purported employee’s location from the destination of company equipment.
The State Department is also offering potential rewards of up to $5 million for information that supports international efforts to disrupt DPRK illicit financial activity, including cybercrime, money laundering and sanctions evasion.
