More than 70 US companies were affected by the operation, according to the department. The US Department of Justice (DOJ) has announced a coordinated crackdown on a North Korean remote IT worker scheme that allegedly infiltrated dozens of American companies using stolen identities, warning businesses about a growing threat that generated millions of dollars for Pyongyang.
The action includes criminal charges against multiple suspects, two arrests, searches of dozens of suspected “laptop farms” and the seizure of approximately 187 laptops and related devices used to help North Korean operatives obtain remote jobs at US companies.
North Korean workers got remote jobs at US companies from 2019 to around July 2025, according to an indictment unsealed in the Northern District of Ohio. They used stolen or fabricated identity documents, plus VPNs and proxy infrastructure, to appear to be U.S.-based employees.
The scheme generated about $3 million in revenue, believed to have been sent to sanctioned North Korean entities. Victims included companies in health care, communications, cyber support, retail and manufacturing across Ohio, 16 other states and Washington, D.C. Investigators seized approximately 187 laptops and remote-access devices that allegedly enabled the fraud. The indictment also names 10 China-based defendants, with two more under seal. The FBI said 14 people in total face charges. 21 to Sept. 25, the FBI searched more than 40 residences in Texas in what it calls Operation Lonestar Roundup. Agents seized about 187 laptops and KVM devices. The department published 11 email addresses it says the operatives used and urged employers to add them to their screening indicators: [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] The FBI issued a public service announcement with guidance for companies. A 2022 advisory said individual North Korean IT workers can earn up to $300,000 a year. The State Department is offering rewards of up to $5 million for information that helps disrupt North Korea’s illicit financial activities.
U.S.-based facilitators hosted the laptops that victim companies issued to these “employees” at their homes, the so-called laptop farms. As part of the operation, the FBI executed searches at more than 40 locations in Texas believed to be connected to “laptop farms” used by North Korean workers. The DOJ said the activity has been linked to a threat group known as “Famous Chollima,” which has previously been associated with North Korean IT worker operations Two US nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on charges of wire fraud, money laundering and identity theft. “Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs,” said U.S.
They set up the machines, installed remote-access software and transferred the earnings to accounts controlled by North Korea. From Sept. Cybersecurity firm CrowdStrike identified the group as “Famous Chollima. Attorney Ryan Raybould of the Northern District of Texas. It warns that North Korean workers increasingly recruit American facilitators to get around better detection. They give those facilitators a wider range of tasks and sometimes subcontract whole jobs to third-party foreign nationals. Some have also committed data extortion and stolen sensitive company data. The department noted that the court filings contain allegations, and all defendants are presumed innocent until proven guilty. You use AI every day. Now get your AI Quotient. Take the AIQ test.