DOJ charges 14 in North Korean IT salary scheme

Prosecutors charged 14 people and seized about 187 devices from Texas laptop farms in a North Korean IT-salary scheme worth about $3 million.

The U.S. Justice Department charged 14 people in Operation Lonestar Roundup over a North Korean remote IT-worker scheme that used stolen or fabricated identities to obtain jobs and collect about $3 million. CyberScoop, Help Net Security, and The Hacker News say more than 70 U.S. companies were affected from 2019 through 2025, while later reports put the end at about July 2025 and BleepingComputer says 70 companies. Two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested on wire-fraud, money-laundering, and identity-theft allegations. Help Net Security says the Ohio indictment also names ten China-based defendants, The Hacker News describes 14 U.S. and Chinese nationals with the rest at large, and BleepingComputer reports both the 14 charges and a separate announcement charging 12 Chinese defendants. Between September 21 and 25, 2026, the FBI searched Texas sites—more than 40 laptop farms according to Help Net Security and The Hacker News, or 40 residences according to BleepingComputer—and seized about 187 computers or laptops and KVM devices. Help Net Security says workers installed remote-access software and forwarded about $3 million toward North Korea, with Pyongyang taking an estimated 85–90% of revenue; the FBI also describes interview and drug-test stand-ins, data theft, extortion, and subcontracting abroad. CrowdStrike attributes the activity to Famous Chollima, also known as purpledelta and Wagemole or WageMole, and the State Department is offering up to $5 million for disrupting information.

• The Justice Department’s Operation Lonestar Roundup charged 14 people; U.S. citizens Michael James Bostelle and Juan Cecilio Pena Carrillo were arrested.
• Sources disagree on related Chinese defendants: Help Net Security says the Ohio indictment names ten people in China, while BleepingComputer reports a separate charging announcement for 12 Chinese nationals; The Hacker News says the other…
• An Ohio case describes stolen or fabricated identities used at 70 or more than 70 U.S. companies from 2019 until 2025, with later reports specifying about July 2025, generating about $3 million.
• FBI searches in Texas from September 21–25, 2026, covered 40 residences or more than 40 laptop farms and seized about 187 laptops or computers and KVM devices.
• Allegations include remote-access software, paid stand-ins for interviews and drug tests, laptop hosting, sensitive-data theft, extortion, and subcontracting work to freelancers in South Asia or West Africa.
• Help Net Security says about $3 million was forwarded toward North Korea and that Pyongyang takes an estimated 85–90% of the revenue.
• CrowdStrike links the activity to Famous Chollima, also tracked as purpledelta and Wagemole (BleepingComputer spells it WageMole).
• The State Department is offering up to $5 million for information that disrupts the scheme.