The Justice Department unsealed a four-count indictment on October 13 charging 14 people in a scheme that placed North Korean IT workers in remote jobs at more than 70 US companies. The FBI also searched more than 40 Texas residences suspected of operating “laptop farms.”
Indictment Names Two Arrested US Nationals and 12 Other Defendants
The indictment, filed in the Northern District of Ohio, charges wire fraud, money laundering and identity theft. Two of the defendants are US nationals who were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten of the remaining defendants are China-based individuals, and two more defendants are unnamed.
Prosecutors also describe Ohio resident Trey Michael Nolte as a co-conspirator, though he is not charged. They say he ran a shell company, recruited Bostelle, received US company laptops, sent packages to China and laundered pay to North Korea.
Operation Lonestar Roundup Seized About 187 Devices
The FBI’s Operation Lonestar Roundup, carried out from September 21 to 25, searched more than 40 Texas residences suspected of serving as laptop farms. Agents seized about 187 laptops and KVM switches. The DOJ did not say whether the arrests in the indictment are linked to the Texas raids.
How the Scheme Placed North Korean Workers Inside US Companies
According to prosecutors, operatives used stolen or fabricated identities to hold remote jobs at more than 70 companies across 17 states and Washington, DC. The victims include organizations in healthcare, cybersecurity, retail, manufacturing and communications. The scheme collected more than $3 million, with proceeds sent to North Korea to fund weapons programs.
US-based hosts keep company-issued laptops at their homes and install remote-access software on them. That arrangement lets workers located overseas appear to log in from inside the country, which defeats location-based checks that employers use to confirm a new hire.
The Timeline: 2019 Through 2025 or 2026
Sources disagree on how long the scheme ran. The DOJ-based accounts say it ran from 2019 through 2025, while The Record reports that it ran through 2026.
Famous Chollima and the Earnings Behind the Operation
CrowdStrike tracks the group behind this type of activity as Famous Chollima. The company published guidance with the FBI on how to spot fraudulent job applicants. Individual operatives can earn up to $300,000 a year, and some steal data and demand extortion payments from the employers that hired them.
Insider Risk Reaches Companies That Never Saw a Network Intrusion
The case moves the threat from a technical intrusion to a hiring problem. A company that employs one of these workers has not been breached in the usual sense: the worker has legitimate credentials, passes an interview and receives a corporate laptop. That leaves nothing for a network defender to flag until someone checks where the keystrokes originate.
The seizure of KVM switches alongside laptops is consistent with the remote-control setup the indictment describes, in which a person in another country operates a machine sitting in a US residence. The charging of two US nationals shows how much the scheme depends on domestic hosts, who supply addresses, devices and a US presence that overseas workers cannot provide themselves.
The FBI and CrowdStrike guidance is aimed at hiring teams, not network defenders, and the scale of 70-plus affected employers across five sectors suggests that these workers did not concentrate on a single industry. Cybersecurity companies are among the affected sectors, alongside healthcare, retail, manufacturing and communications, though the sources do not name the individual employers.
The four counts cover wire fraud, money laundering and identity theft. Of the 14 defendants, only Bostelle and Pena Carrillo are reported to be in custody, and the reporting does not say that the 10 China-based defendants or the two unnamed defendants are in custody. The DOJ’s account of the money flow runs from the paychecks of the remote jobs, through US-based laundering by the shell company Nolte allegedly ran, to North Korea.
