North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice.
Arrests in Ohio, raids in Texas
Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were taken into custody under an Ohio indictment for wire fraud, money laundering and identity theft. The same indictment names ten China-based defendants, and the identities of two more remain under seal.
Prosecutors allege that from 2019 to about July 2025, the two men and their co-conspirators received devices issued by the victim companies, installed remote-access software on them and sent the earnings, about $3 million, to accounts controlled by North Korea.
The victims include health care, communications, retail and manufacturing companies in 17 states and the District of Columbia.
In Texas, FBI agents searched more than 40 suspected “laptop farms” between September 21 and 25 as part of Operation Lonestar Roundup, seizing about 187 laptops and KVM (keyboard, video, mouse) devices.
“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas.
“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.” Raybould noted.
US cybersecurity firm CrowdStrike, which helped the FBI disrupt the operation, tracks this group of North Korean IT workers and their helpers as “Famous Chollima.”
“Laptop farms are vital to FAMOUS CHOLLIMA’s revenue-generating operations because they solve three problems the adversary cannot easily overcome from abroad: physical, financial, and legal,” CrowdStrike wrote in a blog post.
“Without a U.S.-based presence, FAMOUS CHOLLIMA’s operatives would be unable to receive and configure employer-provided hardware, defeat geolocation-based fraud controls, or navigate the identity verification systems that gatekeep legitimate employment,” the company added.
Stolen identities and paid helpers
In a public service announcement published the same day, the FBI said most of the names and addresses the workers give to employers belong to other people. Some got jobs with access to sensitive personal data, which they exfiltrated and used in their schemes, and in isolated cases they tried to extort the owners of that information.
The operatives increasingly pay Americans to appear on camera, take part in job interviews, verify fake identities, lend their social media or professional networking accounts, or ship packages. The bureau says they “strategically target those under financial stress.”
“These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny,” the FBI warned.
The FBI also reported death threats against former managers and their families after the workers were fired, and threats to leak corporate data unless they were paid. North Korea’s government receives an estimated 85-90% of the revenue the workers generate.
The arrests follow a string of US cases against people who helped North Korean IT workers. In November 2025, five men admitted to helping the workers get hired by US companies, and in April 2026, two New Jersey men were sentenced to nine and nearly eight years in prison for their roles in a scheme that generated $5 million for North Korea.
Help Net Security recently reported that researchers found suspected North Korean workers had moved beyond IT into sales, marketing and healthcare jobs.
