FEDERAL authorities have disrupted North Korean remote-work schemes that funnel illicit activity through U.S. companies. The Department of Justice announced coordinated actions and unsealed a four‑count indictment charging 14 individuals with wire fraud, money laundering and identity theft. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested in connection with the case.
In Texas, the FBI conducted Operation Lonestar Roundup between 21 and 25 September, raiding more than 40 suspected DPRK IT worker laptop farms and seizing about 187 laptops and associated KVM switches. The indictment states that company laptops were hosted at domestic homes and accessed remotely, allowing DPRK operators to log in from abroad while appearing to work inside the United States.
Authorities attribute the activity to the North Korean government and its overseas operatives, with ten China‑based individuals also charged for supporting the network. The operation, tracked by CrowdStrike as Famous Chollima, relied on stolen American identities, proxy infrastructure and domestic facilitators.
Prosecutors say the multi‑year scheme ran from 2019 to July 2025 and affected more than 70 U.S. companies across healthcare, retail, manufacturing, communications and cyber support sectors in 17 states plus Washington, D.C., generating over $3 million in illicit revenue. Some individuals allegedly stole proprietary data and sought extortion payments, with funds routed to sanctioned North Korean entities for weapons programmes.
The public‑facing guidance from the FBI and CrowdStrike urges heightened hiring scrutiny and ongoing monitoring of corporate laptops for unauthorised remote‑access tools and KVM devices. Authorities caution that operatives now hire American facilitators to pass video interviews or subcontract tasks to foreign nationals, underscoring the need for rigorous identity verification and vigilant detection of suspicious activity in hiring and remote access processes.