DOJ Announces Coordinated Actions Against North Korean IT Worker Schemes Targeting U.S. Companies

Charges and Arrests in Ohio

The Justice Department announced on Tuesday, October 13, 2026, that U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested on a four-count wire fraud, money laundering, and identity theft indictment. The indictment also charges China-based defendants Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. The identities of two additional defendants remain under seal.

According to the indictment, from 2019 to in or around July 2025, North Korean IT workers obtained remote positions at U.S. companies by using stolen or fabricated identity documents and virtual private networks and proxy infrastructure to appear as U.S. persons working from within the United States. U.S.-based facilitators received and hosted multiple employer-issued laptops at their residences, known as laptop farms, configured the devices, installed remote-access software, and transferred earnings to DPRK-controlled accounts. The scheme affected more than 70 employers in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia, generating more than $3 million in revenue believed to have been sent to sanctioned DPRK-controlled entities.

Operation Lonestar Roundup in Texas

Between September 21 and September 25, the FBI conducted searches and other law enforcement actions at more than 40 residences in Texas known or suspected of operating as laptop farms. During Operation Lonestar Roundup, the FBI seized approximately 187 laptops and KVM devices that workers and facilitators used to obtain remote employment and generate revenue for the North Korean regime. Cybersecurity firm CrowdStrike identified the worker group as "Famous Chollima" and listed fraudulent email accounts used in the schemes, including [email protected] and [email protected], which the FBI encourages employers to add to their indicators of the threat.

FBI Cyber Division Assistant Director Brett Leatherman said the coordinated actions secured charges against 14 individuals, two arrests, seizures of nearly 190 devices, and operations at more than 40 suspected laptop farms, adding that close coordination between the private sector and federal law enforcement was central to the operation.

Advisories and the Broader Initiative

The FBI issued a Public Service Announcement describing the evolving threat and detection tips, noting that North Korean workers increasingly recruit American facilitators to counter improved private-sector detections and in some cases subcontract entire jobs to third-party foreign nationals. CrowdStrike also published a blog post on its monitoring of customer networks and collaboration with the FBI.

The actions are the latest under the DPRK RevGen: Domestic Enabler Initiative, a joint effort of the National Security Division and the FBI Cyber and Counterintelligence Divisions, with previous announcements in June 2025, November 2025, April 2026, and May 2026. The Justice Department noted that DPRK IT workers have committed data extortion and exfiltrated sensitive company data. The State Department offers rewards of up to $5 million for information disrupting DPRK illicit financial activity, and all defendants are presumed innocent until proven guilty.

Sources: Techmeme · The New York Times · Techmeme