TWO US nationals have been arrested in a law enforcement crackdown on North Korean IT worker “laptop farm” schemes. Michael James Bostelle, from Pennsylvania, and Juan Cecilio Pena Carrillo, from Texas, are accused in a four‑count indictment of helping North Korean IT workers illegally secure remote work at US companies. The multi‑year fraud, running from 2019 to July 2025, allegedly generated more than $3 million in fraudulent revenue.
The scheme involved housing and configuring laptops issued by victim US companies so that the IT workers appeared to be operating from the United States, using fake identities and VPN or proxy infrastructure to mask real locations. IT workers, aided by US facilitators, are said to have gained employment at more than 70 US organisations across sectors including communications, cyber support, healthcare, manufacturing and retail.
In a separate operation named Lonestar Roundup, the FBI searched 40 locations in Texas suspected of running laptop farms for IT workers and seized 187 laptops and associated KVM devices used to commit the fraud. CrowdStrike has linked the operation to the broader North Korean “Famous Chollima” scheme, which employs deception techniques such as rotating addresses and staffing firms to redirect devices to farm locations.
The FBI and cybersecurity researchers describe a pattern of remote access tools and techniques designed to maintain a US footprint for illicit activity, while emphasising that responses such as “identity in depth”—layered detection and continuous identity verification—are needed to counter these schemes. The article notes that the impact spans numerous critical sectors, but the disruption of laptop farms is expected to have limited effect on the overall operation.