Do Son 
TL;DR
Federal authorities arrested two U.S. nationals and charged 14 individuals in a major crackdown on a North Korean remote employment network. Furthermore, law enforcement raided over 40 suspected DPRK IT worker laptop farms across Texas and seized 187 devices. These operations disrupted a fraud ring that allegedly infiltrated more than 70 American businesses.
What Happened in the Operation
The Department of Justice announced coordinated actions against North Korean remote employment operations in Ohio and Texas. Specifically, authorities unsealed a four-count indictment charging 14 people with wire fraud, money laundering, and identity theft. Consequently, federal agents arrested U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas.
Meanwhile, the FBI executed Operation Lonestar Roundup between September 21 and September 25. Agents searched more than 40 Texas residences suspected of operating as DPRK IT worker laptop farms. During these raids, officials seized approximately 187 laptops and keyboard, video, and mouse (KVM) switches. According to the indictment, U.S. facilitators hosted company laptops at their homes and installed remote-access software. Therefore, every single DPRK IT worker could log in from abroad while appearing to work inside the United States.
Who Is Behind the Activity
Authorities attribute this campaign with high confidence to the North Korean government and its overseas operatives. In addition, the indictment charges 10 China-based individuals with supporting the fraudulent network, while two other suspects remain under seal. In a separate technical report, cybersecurity firm CrowdStrike tracks this specific DPRK IT worker group and its helpers as Famous Chollima.
Both federal investigators and CrowdStrike researchers note that these operatives rely on stolen American identities, proxy infrastructure, and domestic facilitators. “This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.”
Impact and Financial Scale
Prosecutors allege the multi-year scheme ran from 2019 through July 2025 and affected over 70 U.S. companies. Victims included businesses in the healthcare, retail, manufacturing, communications, and cyber support sectors across 17 states and Washington, D.C. Furthermore, the indictment claims the operation generated more than $3 million in illicit revenue for the operatives. Authorities believe the suspects sent these funds to sanctioned North Korean entities to pay for weapons programs.
Separate advisories from the FBI, Treasury, and State Department confirm the broader financial danger of these operations. For example, individual operatives can earn up to $300,000 a year and generate hundreds of millions of dollars collectively. Moreover, officials warn that some workers steal proprietary company data and demand extortion payments.
How Companies Can Stay Protected
Additionally, the FBI and CrowdStrike published new guidance to help employers spot fraudulent applicants. “These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices,” said U.S. Attorney David M. Toepfer. Specifically, North Korean operatives now hire American facilitators to pass video interviews or subcontract tasks to other foreign nationals. However, security teams can block known indicator emails such as Bright.star.me208@gmail.com, Merrttank.bz@gmail.com, and randyryang@gmail.com. Finally, employers should verify applicant identities carefully and monitor corporate laptops for unauthorized KVM devices or remote-access tools.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
