FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
FBI arrested two Americans and raided 40-plus laptop farms aiding North Korean IT-worker salary fraud.
The US Justice Department says North Korean IT workers used stolen and fake identities to get remote jobs at more than 70 US companies, aided by Americans who hosted company laptops. Michael James Bostelle and Juan Cecilio Pena Carrillo were arrested; an Ohio indictment also names ten China-based defendants. From 2019 to about July 2025 they allegedly installed remote-access software and forwarded about $3 million toward North Korea. Between September 21 and 25, the FBI searched more than 40 Texas laptop farms and seized about 187 laptops and KVM devices. The FBI says some workers stole sensitive data, attempted extortion, and that Pyongyang takes an estimated 85–90% of the revenue.
- Two US men were charged in Ohio with wire fraud, money laundering, and identity theft.
- Prosecutors say the scheme ran from 2019 to July 2025 and sent about $3 million to North Korea.
- FBI searched more than 40 Texas laptop farms and seized about 187 laptops and KVM devices.
- Some workers exfiltrated personal data, extorted employers, or paid Americans to fake interviews.
- CrowdStrike tracks the IT workers and US facilitators as Famous Chollima.
Full article579 words · extracted from helpnetsecurity.com · click to collapse
North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice.
Arrests in Ohio, raids in Texas
Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were taken into custody under an Ohio indictment for wire fraud, money laundering and identity theft. The same indictment names ten China-based defendants, and the identities of two more remain under seal.
Prosecutors allege that from 2019 to about July 2025, the two men and their co-conspirators received devices issued by the victim companies, installed remote-access software on them and sent the earnings, about $3 million, to accounts controlled by North Korea.
The victims include health care, communications, retail and manufacturing companies in 17 states and the District of Columbia.
In Texas, FBI agents searched more than 40 suspected “laptop farms” between September 21 and 25 as part of Operation Lonestar Roundup, seizing about 187 laptops and KVM (keyboard, video, mouse) devices.
“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas.
“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.” Raybould noted.
US cybersecurity firm CrowdStrike, which helped the FBI disrupt the operation, tracks this group of North Korean IT workers and their helpers as “Famous Chollima.”
“Laptop farms are vital to FAMOUS CHOLLIMA’s revenue-generating operations because they solve three problems the adversary cannot easily overcome from abroad: physical, financial, and legal,” CrowdStrike wrote in a blog post.
“Without a U.S.-based presence, FAMOUS CHOLLIMA’s operatives would be unable to receive and configure employer-provided hardware, defeat geolocation-based fraud controls, or navigate the identity verification systems that gatekeep legitimate employment,” the company added.
Stolen identities and paid helpers
In a public service announcement published the same day, the FBI said most of the names and addresses the workers give to employers belong to other people. Some got jobs with access to sensitive personal data, which they exfiltrated and used in their schemes, and in isolated cases they tried to extort the owners of that information.
The operatives increasingly pay Americans to appear on camera, take part in job interviews, verify fake identities, lend their social media or professional networking accounts, or ship packages. The bureau says they “strategically target those under financial stress.”
“These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny,” the FBI warned.
The FBI also reported death threats against former managers and their families after the workers were fired, and threats to leak corporate data unless they were paid. North Korea’s government receives an estimated 85-90% of the revenue the workers generate.
The arrests follow a string of US cases against people who helped North Korean IT workers. In November 2025, five men admitted to helping the workers get hired by US companies, and in April 2026, two New Jersey men were sentenced to nine and nearly eight years in prison for their roles in a scheme that generated $5 million for North Korea.
Help Net Security recently reported that researchers found suspected North Korean workers had moved beyond IT into sales, marketing and healthcare jobs.