DOJ charges 14 over a sprawling North Korean remote work scheme
DOJ charged 14 people for a North Korean remote-IT scheme that drew about $3 million from 70 U.S. employers.
The Justice Department charged 14 people and seized about 187 computers in Operation Lonestar Roundup, targeting North Korean remote IT workers and U.S. laptop farms. An Ohio indictment alleges U.S. citizens Michael James Bostelle and Juan Cecilio Pena Carrillo, plus others in China, held jobs at more than 70 companies from 2019 through 2025 and collected about $3 million using stolen or fabricated identities. The FBI says workers now pay stand-ins for interviews, drug tests, and laptop hosting, and CrowdStrike links evolving concealment tactics to Famous Chollima. The State Department is offering up to $5 million for information that disrupts the scheme.
- Fourteen people were charged and about 187 computers seized from laptop farms.
- Workers allegedly used stolen identities at more than 70 U.S. companies.
- The scheme collected about $3 million in pay from 2019 through 2025.
- FBI says facilitators now pose in interviews, host laptops, and sometimes extort employers.
- The State Department offers rewards up to $5 million.
Full article1,107 words · extracted from cyberscoop.com · click to collapse
Get our latest cybersecurity news first on Google.
Operation Lonestar Roundup uncovered an operation that used stolen identities to secretly funnel $3 million from 70 U.S. employers back to Pyongyang.
Listen to this article
0:00
Learn more.
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme.
The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad.
An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. It alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay.
An Ohio resident, Trey Michael Nolte, is also named as a co-conspirator in the indictment, but is not charged. Two unnamed defendants were also charged.
“This investigation is about far more than fraud,” Ryan Raybould, a U.S. attorney in the Northern District of Texas, said in a release. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”
This particular scheme proliferated over the past decade as remote work became more common. There have been multiple indictments since 2024 that have looked to charge willing conspirators in the U.S., while also disrupting the ability for North Korean nationals to successfully earn a paycheck.
Despite those actions, the scheme has persisted. Last month, U.S. and allied governments warned that a North Korean hacking group operating under the country’s Munitions Industry Department’s 313 General Bureau is infiltrating tens of thousands of job seekers’ networks by posing as prospective employers like AI firms to steal sensitive data and millions in cryptocurrency. The intent is to circumvent economic sanctions that prevent the country from bankrolling its military ambitions through legitimate financial channels.
Detailed in an indictment released Tuesday, this particular scheme was allegedly facilitated by Nolte, who kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. The DOJ said Bostelle aided the scheme by providing his name and a fraudulent driver’s license to help a remote worker obtain a job, Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers.
Prosecutors also allege that the men filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity theft victims.
The FBI also released an updated advisory that detailed how the scheme has changed over the past few years. Under pressure from better detection, North Korean workers now pay U.S. citizens to appear in interviews, take drug tests, access accounts, and keep company laptops running at home. They target people under financial strain, whom they see as easier to recruit.
Some go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job.
The advisory also recounted sharper tactics: threats against former managers after firings, demands for payment backed by stolen data, and paid helpers sent to intimidate companies in person.
The group has also changed how they use certain tools. CrowdStrike, which provided assistance to law enforcement, reported that since May, the group has spoofed device identifiers, making a video capture card appear as a webcam, and reused the same disguised device across several jobs. Because these habits resemble normal remote work, no single warning sign catches them, the FBI said, so it called for layered checks throughout employment and warned that blunt filters would screen out qualified applicants.
Adam Meyers, CrowdStrike’s head of counter adversary operations, told CyberScoop while the tradecraft may change, the North Koreans’ goal of evading sanctions remains the same.
“As companies get better at identifying fraudulent workers and law enforcement disrupts their infrastructure, FAMOUS CHOLLIMA is finding new ways to conceal its operations and make the scheme more resilient,” Meyers said. “That’s why disruption is so important. Working with the FBI, we’re not just identifying the threat but dismantling the infrastructure that enables it, forcing the adversary to rebuild and reinvest. Every laptop seized, every facilitator exposed, and every operation disrupted raises the cost of doing business for North Korea.”
Despite the law enforcement effort, CrowdStrike said in its own announcement that this particular action is unlikely to have a lasting effect.
“While disrupting a laptop farm will likely only yield a limited impact on Famous Chollina centered mostly on the geolocation of the takedown, these operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements,” the blog post reads.
The State Department is offering rewards of up to $5 million for further information that disrupts this scheme.
You can read the full indictment below.
UPDATE, 10/14/2026, 11:25 a.m.: This story has been updated with comment from CrowdStrike’s Adam Meyers.
Latest Podcasts
Government
FTC says ‘sextortion’ protection companies deceived customers about services
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media
Technology
Threats
Policy
Major rules for federal contractors handling sensitive data are nearing the finish line
Wiretapping change sparks big privacy fight in the Golden State
Here’s how experts think CISA should tell agencies to protect OT
National cyber director: Government-industry collaboration vital to managing AI risks, competition with nations