The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes.
Famous Chollima (a.k.a. WageMole) is commonly tracked as a North Korean threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime.
Because North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using stolen, rented, or fabricated identities.
In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrency and other assets.
As part of an operation in Texas codenamed “Lonestar Roundup,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.
Laptop farms are locations where facilitators host employer-issued computers that North Korean IT workers access remotely to appear based in the United States.
Law enforcement agents seized approximately 187 laptops and KVM input devices, which were used by Famous Chollima operatives that cybersecurity company CrowdStrike had been tracking since April 2025.
CrowdStrike researchers say that DPRK IT workers used several methods to send the company-issued laptops to the "farm," instead of the address in the provided identity documents:
- Submit fake theft reports to trigger replacement shipments to the farm’s address
- Rotate through residential addresses to obscure the final destination
- Claim last-minute relocations to divert devices mid-shipment
- Abuse IT staffing roles they sometimes hold to covertly redirect shipments
CrowdStrike says public exposure has pressured the operatives, leading them to rely more on spoofing device identifiers or even reusing identifiers across victim organizations.
While CrowdStrike acknowledges that actions like Lonestar Roundup will likely have limited impact, the company called the operation “the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.”
The U.S. DoJ also published an Ohio indictment describing a remote IT workers scheme that ran from 2019 to July 2025, impacted 70 companies in the country, and generated roughly $3 million for the North Korean threat actors.
The workers used stolen or fabricated identities, VPNs, and proxy infrastructure to appear U.S.-based, while their American facilitators hosted the company-issued laptops, installed remote-access software, and transferred the earnings to DPRK-controlled accounts.
Authorities arrested two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, on charges of wire fraud, money laundering, and identity theft.
Separately, the DoJ announced similar charges against 12 Chinese defendants.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.