The U.S. Department of Justice has announced a coordinated enforcement action against networks accused of helping North Korean remote information-technology workers obtain jobs at American companies under false identities. The operation resulted in two arrests, charges against additional defendants and the seizure of about 187 laptops and related devices, according to an October 13 statement from the department.
The Justice Department said the actions were carried out in Ohio and Texas and were aimed at disrupting schemes that allegedly generated revenue for the Democratic People's Republic of Korea. Reuters independently reported the announcement and said the two arrested U.S. nationals were Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both were charged in an indictment alleging wire fraud, money laundering and identity theft. The charges are allegations, and all defendants are presumed innocent unless proven guilty.
More than 40 suspected laptop farms searched
Between September 21 and September 25, the FBI searched or took other law-enforcement action at more than 40 residences in Texas believed to be operating as so-called laptop farms, the department said. Investigators seized approximately 187 laptops and keyboard-video-mouse devices. Such setups can make a worker connecting from abroad appear to be using a computer inside the United States.
Prosecutors allege that North Korean IT workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to pose as U.S.-based applicants. U.S. facilitators allegedly received company-issued computers at their homes, configured the machines, installed remote-access software and helped move earnings to accounts controlled by the overseas operators.
The indictment described by the Justice Department covers a multi-year scheme running from 2019 until around July 2025. Officials said it affected more than 70 U.S. employers and generated approximately $3 million in revenue for the overseas IT workers. The targeted employers operated in sectors including health care, communications, cybersecurity support, retail and manufacturing, across Ohio, 16 other states and the District of Columbia.
Fourteen people charged in the broader action
The FBI said the coordinated actions secured charges against 14 people, including the two U.S. nationals who were arrested. The indictment also names 10 people based in China, while the identities of two additional defendants remain under seal. Reuters reported that lawyers for the two arrested defendants could not immediately be reached for comment.
Authorities say the operation, named Operation Lonestar Roundup, is part of a broader effort to counter North Korea's use of remote IT employment to raise funds and gain access to corporate networks. The Justice Department said the proceeds were believed to have been sent to sanctioned North Korean entities linked to weapons programs. That claim forms part of the government's case and has not yet been tested in court.
Warning for remote-hiring systems
The case highlights the security challenges facing companies that recruit technical workers remotely. According to the Justice Department, the alleged schemes relied on combinations of stolen identities, alias email accounts, proxy computers, payment platforms and U.S.-based intermediaries. Those layers can make standard document checks or location signals appear legitimate.
The FBI issued updated guidance for companies alongside the operation. Officials said organizations should strengthen identity verification, check for inconsistencies in application and onboarding records, monitor unusual remote-access patterns and verify who is physically operating company equipment. The department also urged employers to treat suspicious hiring activity as both a fraud risk and a potential network-security threat.
The latest enforcement action follows earlier U.S. warnings and prosecutions involving North Korean remote IT workers. While the new seizures may disrupt the specific infrastructure described in the case, authorities indicated that the wider tactic is evolving, with operators increasingly recruiting intermediaries to defeat stronger corporate screening.
