Across more than 70 American companies, someone who looked like a diligent remote engineer could actually be a salaried instrument of the North Korean regime, with the paychecks traveling toward Pyongyang’s weapons programs. On Tuesday, the U.S. Department of Justice announced charges against 14 people, two arrests and the seizure of about 187 devices. The real story is not the raid. It is the uncomfortable fact that American hiring habits, American addresses and American identities made the scheme possible, and that years of warnings failed to bolt the door.
Key points:
- The Justice Department charged 14 people, arrested two U.S. nationals and seized about 187 laptops and KVM devices in coordinated Ohio and Texas actions.
- The indictment alleges a scheme running from 2019 to about July 2025 that touched more than 70 companies and generated roughly $3 million.
- Under Operation Lonestar Roundup, the FBI searched more than 40 known or suspected laptop farms in Texas.
- U.S.-based facilitators are the linchpin, and the Justice Department says North Korean workers are recruiting more of them.
- The charges are allegations, and every defendant is presumed innocent until proven guilty.
The Justice Department said the coordinated actions unfolded in two theaters. In the Northern District of Ohio, prosecutors announced a four-count indictment alleging wire fraud, money laundering and identity theft. It names two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, along with 10 China-based defendants, while two more defendants remain under seal. In Texas, the FBI searched more than 40 residences between Sept. 21 and Sept. 25 that were known or suspected to operate as laptop farms, under a banner called Operation Lonestar Roundup.
The indictment sketches a long game. From 2019 to about July 2025, North Korean information technology workers allegedly won remote jobs with stolen or fabricated identity documents, then hid behind virtual private networks and proxy infrastructure to look like Americans working on American soil. Victim employers sat in health care, communications, cyber support, retail and manufacturing across Ohio, 16 additional states and the District of Columbia. Prosecutors put the haul at roughly $3 million, believed to have flowed to sanctioned entities controlled by Pyongyang. For a government boxed in by sanctions, a remote paycheck is quieter than a missile test, and far harder to spot.
Inside the laptop farm, where American doorsteps become Pyongyang’s front line
A laptop farm is a simple piece of deception with a brutal payoff. A company ships a work laptop to what it believes is a new hire’s home. A U.S.-based facilitator receives the machine, keeps it powered on, installs remote-access software and lets the real worker log in from far away. The FBI’s public service announcement says facilitators have also set up financial accounts, created profiles on job search sites, helped fund tools such as artificial intelligence models and attended virtual interviews on behalf of the workers. Some facilitators take a share of the proceeds.
That detail should trouble every hiring manager in the country. The facilitators are not phantoms. They are people with mailboxes and driveways, living inside the same economy whose companies they allegedly helped to fleece. The FBI has described such helpers as both witting and unwitting, a distinction that matters in court but hardly matters to the employer whose network was just opened to a stranger. U.S. Attorney Ryan Raybould of the Northern District of Texas declared, “we will not allow enemies of the United States to exploit our businesses.”
None of this arrived without warning. The FBI, Treasury and State departments issued a joint advisory in May 2022, which warned that individual workers can earn up to $300,000 a year and that collectively they generate hundreds of millions of dollars annually for entities such as North Korea’s Ministry of Defense. The Office of the Director of National Intelligence followed in July 2023, and Washington and Seoul issued joint guidance that October. The FBI has since published public service announcements in May 2024, January 2025, July 2025 and again with Tuesday’s announcement. The Justice Department’s DPRK RevGen: Domestic Enabler Initiative has already announced actions in June 2025, November 2025, April 2026 and May 2026. Four years of alarms, and still an alleged scheme that ran for roughly six.
A threat that keeps adapting
The adversary is evolving faster than the defenses. CrowdStrike, the cybersecurity firm that tracks this network under the name Famous Chollima, reported in 2025 that its threat hunters investigated more than 320 cases of North Korean operatives landing remote jobs in a single year, a 220% jump in activity. Adam Meyers, the firm’s head of counter adversary operations, said, “We see them almost every day now.” The firm also found operatives leaning on generative artificial intelligence at every stage, including while juggling three or four jobs at once.
Pressure produces adaptation. The Justice Department says North Korean workers are increasingly recruiting American facilitators to counter better private-sector detection and tougher enforcement, hiring them for a wider range of tasks and sometimes subcontracting whole jobs to third-party foreign nationals. The stakes also extend beyond salaries. The department warns that workers posing as legitimate employees have committed data extortion and exfiltrated proprietary and sensitive data from U.S. companies. A paycheck funneled to Pyongyang is the visible theft. The invisible one is a stolen trove of source code, customer files and internal secrets walking out the digital back door.
Sources include:
Please contact us for more information.