The US Department of Justice announced coordinated law enforcement actions in Ohio and Texas, charging 14 individuals and targeting more than 40 suspected laptop farms allegedly used to support North Korea’s remote IT worker operations.

The US Department of Justice (DOJ) has announced a major crackdown on an alleged North Korean scheme that used stolen identities and covert computer infrastructure to secure remote IT jobs at American companies and funnel earnings to the Democratic People’s Republic of Korea (DPRK).

The operation resulted in two arrests, an indictment against 14 individuals, searches at more than 40 suspected laptop farms in Texas, and the seizure of approximately 187 laptops and keyboard, video, and mouse (KVM) devices.

The coordinated enforcement effort included Operation Lonestar Roundup, an FBI-led initiative targeting US-based facilities allegedly used by North Korean IT workers and their domestic facilitators.

Alleged Fraud Scheme Targeted US Companies

According to a four-count indictment announced by the US Attorney’s Office for the Northern District of Ohio, the alleged scheme operated from 2019 through approximately July 2025. The defendants allegedly used stolen or fabricated identity documents, virtual private networks (VPNs), and proxy infrastructure to make North Korean IT workers appear to be US-based applicants.

The workers allegedly obtained remote IT positions at American companies while relying on US-based facilitators to receive and host company-issued laptops at residential properties. These so-called laptop farms allowed workers overseas to access employer devices remotely while concealing their actual locations.

The facilitators allegedly configured the computers, installed remote-access software, and transferred earnings to accounts controlled by North Korean interests.

The scheme reportedly generated approximately $3 million in revenue and affected more than 70 US employers across healthcare, communications, cybersecurity support, retail, and manufacturing. The affected companies were located in Ohio, 16 other states, and the District of Columbia.

Investigators believe the proceeds were transferred to sanctioned entities controlled by North Korea, potentially supporting the regime’s weapons programs.

Two Arrests and Charges Against 14 Individuals

US authorities arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas in connection with the alleged scheme.

The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. The identities of two additional defendants remain under seal.

The charges include wire fraud, money laundering, and identity theft. The allegations have not been proven in court.

The FBI’s Cleveland Field Office is investigating the case, with prosecutors from the US Attorney’s Office for the Northern District of Ohio and the DOJ’s National Security Division handling the prosecution.

FBI Targets More Than 40 Suspected Laptop Farms

As part of Operation Lonestar Roundup, the FBI conducted searches and other law enforcement actions at more than 40 residences across Texas between September 21 and September 25.

Authorities seized approximately 187 laptops and KVM devices allegedly used to facilitate fraudulent remote employment and generate revenue for North Korea.

KVM devices allow users to control computers remotely, making them useful for managing systems located at a different physical location. In the alleged scheme, this infrastructure helped overseas workers access employer-provided hardware housed inside the United States.

Cybersecurity firm CrowdStrike has identified the North Korean IT workers and their alleged facilitators involved in this activity as Famous Chollima.

Cybersecurity Risks Extend Beyond Financial Fraud

The DOJ warned that the operation represents more than an employment fraud scheme. By using stolen identities to gain access to US corporate environments, the alleged activity can expose businesses to data theft, unauthorized system access, and broader cybersecurity risks.

Assistant Attorney General John A. Eisenberg said North Korea’s IT worker operations generate revenue for illicit purposes, including weapons development, while threatening the security of US employers’ IT systems and data.

The FBI also highlighted the importance of cooperation between private companies and federal investigators in disrupting the operation. The agency has issued a public service announcement containing mitigation guidance for US businesses.

What Companies Should Do

The case underscores the need for organizations to strengthen hiring verification and remote-work security procedures. Recommended safeguards include:

• Verify candidate identities: Validate identity documents and employment histories before onboarding remote IT personnel.
• Strengthen access controls: Apply multifactor authentication, least-privilege access, and continuous monitoring to corporate systems.
• Review remote access: Investigate unusual login locations, VPN usage, proxy connections, and remote-access software installations.
• Monitor company-issued devices: Track device enrollment, management status, and access patterns to identify potentially unauthorized use.
• Coordinate with security teams: Establish procedures for reporting suspicious hiring activity and sharing relevant indicators with law enforcement.

The DOJ’s latest actions highlight the growing challenge of detecting state-linked threat actors operating through seemingly legitimate remote employment arrangements. For US businesses, stronger identity verification and endpoint security controls are increasingly important to reducing both financial and national security risks.