The Justice Department today announced charges against 14 people and the seizure of about 187 computers from more than 40 Texas residences that hosted "laptop farms" for North Korean remote IT workers. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on a Northern District of Ohio indictment that also names China-based co-conspirators. The scheme allegedly hit more than 70 U.S. employers and generated about $3 million.
The Texas side of the case is Operation Lonestar Roundup. Between September 21 and 25, FBI agents searched known or suspected farm houses and grabbed laptops plus KVM gear that facilitators used to keep employer-issued machines online for workers overseas. CrowdStrike, which worked with the bureau, tracks the group as Famous Chollima. Companies in health care, communications, cyber support, retail, manufacturing, aerospace, energy, finance, and defense engineering showed up among the victims.
The playbook is ugly and effective. Operatives apply with stolen or fake IDs, route company laptops to U.S. facilitators who install remote-access tools, then appear to log in from American addresses while sending pay to DPRK-controlled accounts. CrowdStrike says some workers filed false theft reports or claimed sudden moves so replacements shipped to farm addresses. Assistant Attorney General John A. Eisenberg tied the revenue to weapons programs; the FBI also put out fresh hiring red flags for employers.