The Briefing:
- 14 people charged, including two U.S. nationals — Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas — and ten co-conspirators operating from China
- Approximately $3 million in fraudulent wages routed to sanctioned North Korean entities through this operation; individual DPRK operatives can earn up to $300,000 per year
- 187 laptops and KVM devices recovered from over 40 Texas residences during Operation Lonestar Roundup, conducted September 21 through 25, 2026
- Health care, communications, cyber support, retail, and manufacturing firms across 17 states and the District of Columbia identified as victims in the Northern District of Ohio indictment
The FBI and Department of Justice announced a sweeping enforcement action on October 13, 2026, charging 14 individuals and seizing approximately 187 devices tied to a North Korean government scheme that funneled wages from more than 70 American companies over roughly six years. The coordinated disclosure followed a five-day enforcement sweep across Texas and the unsealing of a 58-page federal indictment in Ohio that prosecutors describe as the most extensive domestic crackdown yet against Pyongyang's effort to turn remote hiring into a covert weapons revenue channel.
Fabricated Résumés, Real Salaries: How North Korea Built a Shadow Payroll Inside U.S. Companies
According to the 58-page indictment unsealed in the Northern District of Ohio, the fraud ran from 2019 to approximately July 2025 and rested on a calculated two-step deception. North Korean IT workers stationed primarily in China acquired stolen or fabricated American identities and routed their internet connections through virtual private networks to hide their actual location. Once companies extended job offers, the new "employees" directed employer-issued laptops not to themselves but to American accomplices — ordinary residents who agreed to host what prosecutors call "laptop farms" out of their homes.
Those facilitators loaded the devices with remote-access software, establishing a digital bridge that let DPRK operatives control corporate accounts from abroad. Every login appeared, to standard monitoring tools, to originate from inside the United States.
Two Americans are now in federal custody on charges of wire fraud, money laundering, and identity theft. Bostelle and Pena Carrillo are accused of managing parts of that hardware infrastructure. Named alongside them in the Ohio indictment are ten Chinese nationals — including Sun Sheng Ming, Wang Jian Jun, and eight associates — whom prosecutors portray as an overseas coordination layer that directed U.S. facilitators and received diverted earnings. A third American, Tey Michael Nolte, was named in the indictment but has not been charged at this time.
Operation Lonestar Roundup: What FBI Agents Found Inside Those Texas Homes
Between September 21 and September 25, FBI agents executed search warrants at more than 40 residences across Texas, pulling apart the physical layer of the operation. The recovered hardware — 187 laptops and KVM (keyboard-video-mouse) switchers — represents the actual workstations through which North Korean operatives juggled multiple corporate identities simultaneously, in some cases holding three or four salaried positions at once.
Cybersecurity firm CrowdStrike was the only private-sector company involved in the FBI operation. In a blog post published October 13, the firm's Counter Adversary Operations team revealed it had tracked the network between April 2025 and June 2026, supplying the FBI with threat intelligence, technical analysis, and detailed maps of adversary infrastructure. CrowdStrike tracks this particular DPRK IT worker threat actor under the designation "Famous Chollima."
The broader scope of Famous Chollima's reach is documented in separate CrowdStrike research. The firm's 2025 Annual Threat Hunting Report, published in August 2025, recorded a 220% year-over-year surge in Famous Chollima activity, with investigators handling more than 320 incident cases over a single 12-month period. A later CrowdStrike technology threat landscape report covering April 2025 through May 2026 found the group responsible for 47% of all state-sponsored hands-on-keyboard intrusions targeting U.S. tech companies — a dominance the firm attributes in large part to the operatives' use of generative AI to pass technical interviews, generate working code, and maintain multiple employer relationships at the same time.
Every Paycheck Had a Destination: The Weapons Connection That Makes This a National Security Issue
FBI Cyber Division Assistant Director Brett Leatherman stated plainly in the October 13 announcement that North Korea "continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs." Assistant Attorney General for National Security John A. Eisenberg echoed that framing, noting that the regime's IT worker schemes exist to raise funds "for various illicit purposes, including the development of weapons that could ultimately target the U.S. or its allies."
The $3 million documented in this indictment is a fraction of a far larger pipeline. A joint advisory issued in May 2022 by the State Department, the Department of the Treasury, and the FBI warned that thousands of DPRK IT workers were already operating globally, generating wages routed to sanctioned North Korean entities. Estimates compiled since then from United Nations reporting and U.S. government assessments place the regime's annual earnings from these schemes in the range of hundreds of millions of dollars.
What Every U.S. Employer Needs to Do Before Extending the Next Offer Letter
Investigators identified a cluster of fraudulent Google email accounts tied to the network — details documented in the Northern District of Texas enforcement announcement. Employers and security teams are advised to cross-check applicant addresses against those accounts and to treat any unexpected request to reroute a company-issued laptop before or during onboarding as an immediate red flag requiring investigation.
Federal prosecutors also flagged a tactical shift that makes passive defenses inadequate. DPRK operatives, adapting to tighter corporate monitoring, are now actively recruiting U.S. residents to handle tasks beyond laptop hosting — in some cases outsourcing entire blocks of assigned work to overseas third parties. That evolution means identity verification at the hiring stage, not just network monitoring after a worker is already inside corporate systems, has become the most urgent control gap for employers to close.
The State Department's Rewards for Justice program maintains standing offers of up to $5 million for information that disrupts North Korea's illicit financial activity, including IT worker schemes. The October 13 enforcement action is the latest in a series of operations carried out under the DOJ's DPRK RevGen: Domestic Enabler Initiative — a joint effort between the National Security Division and the FBI's Cyber and Counterintelligence Divisions that has been running since its March 2024 launch.
© {{Year}} Latin Times. All rights reserved. Do not reproduce without permission.