Thursday 15 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

FBI seizes 187 laptops, arrests two US nationals in North Korean remote IT worker scheme

Operation 'Lonestar Roundup' targets laptop farms used by Famous Chollima threat group to bypass sanctions

By LineZotpaper
Published
Read Time2 min
The US Department of Justice has disrupted a North Korean remote IT worker scheme by arresting two American facilitators, charging 14 individuals, and seizing nearly 187 laptops from so-called 'laptop farms' in Texas. The operation, codenamed Lonestar Roundup, targeted the Famous Chollima threat group (also known as WageMole), which uses stolen identities to place North Korean IT workers at companies worldwide and generate revenue for the DPRK regime.

Between September 21 and 25, FBI agents searched 40 residences in Texas suspected of hosting laptop farms — locations where employer-issued computers are kept so that North Korean IT workers can access them remotely and appear to be based in the United States. Along with the laptops, law enforcement seized KVM input devices used by the operatives.

CrowdStrike, which had been tracking Famous Chollima since April 2025, assisted the investigation. The cybersecurity firm detailed methods used by North Korean workers to redirect company laptops to farm addresses, including filing fake theft reports to trigger replacement shipments, rotating through residential addresses to obscure final destinations, claiming last-minute relocations, and abusing IT staffing roles to covertly redirect shipments.

Separately, an Ohio indictment described a similar scheme that ran from 2019 to July 2025, impacted 70 US companies, and generated approximately $3 million for North Korean actors. Those workers used stolen identities, VPNs, and proxy infrastructure, while American facilitators hosted laptops, installed remote-access software, and transferred earnings to DPRK-controlled accounts.

Authorities arrested Michael James Bostelle and Juan Cecilio Pena Carrillo on charges of wire fraud, money laundering, and identity theft. CrowdStrike acknowledged that actions like Lonestar Roundup will likely have limited impact but called the operation 'the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.'

§

Analysis

Why This Matters

  • North Korean IT worker schemes allow the DPRK to evade international sanctions and fund its weapons programs by placing operatives in sensitive technology roles.
  • US companies remain vulnerable to hiring individuals using stolen or fabricated identities, risking data theft, malware deployment, and financial loss.
  • The arrests signal increased law enforcement focus on facilitators within the United States who enable these operations.

Background

North Korea is subject to extensive international sanctions, driving its regime to generate revenue through cybercrime and fraudulent employment. Famous Chollima (WageMole) is one of several groups that place North Korean IT workers in remote roles at Western companies, using identity theft and proxy infrastructure to remain undetected. The group has been active for years, with previous incidents involving ransom demands, cryptocurrency theft, and network intrusions.

Key Perspectives

US Law Enforcement: The DoJ and FBI view these arrests as a direct disruption of North Korean revenue streams, targeting the infrastructure that enables remote IT worker fraud. The Ohio indictment provides a detailed example of the scheme's scale and duration. CrowdStrike and Security Researchers: The cybersecurity firm highlights that while individual operations may have limited impact, the public exposure and legal actions increase pressure on North Korean operatives, forcing them to adopt riskier tactics such as spoofing device identifiers. Critics and Skeptics: Some may question the long-term effectiveness of seizing laptops and arresting low-level facilitators, given the DPRK's ability to quickly recruit new accomplices and adapt their methods.

What to Watch

  • Indictments or arrests of additional US-based facilitators in other states.
  • Increased use of biometric verification and background checks by companies hiring remote workers.
  • Potential sanctions or diplomatic actions targeting North Korean cyber operations.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe