DOJ Arrests Two in North Korean Laptop-Farm Scheme Targeting U.S. Employers

The U.S. Justice Department announced two arrests following Operation Lonestar Roundup, in which the FBI searched more than 40 Texas residences during September 21–25 and seized 187 laptops and other devices. Prosecutors allege that U.S. nationals Michael James Bostelle and Juan Cecilio Pena Carrillo helped North Korean IT workers obtain fraudulent remote employment at roughly 70 U.S. companies, generating more than $3 million. U.S.-based facilitators hosted employer-issued laptops and enabled overseas workers to access corporate systems while concealing their locations behind stolen or purchased identities. CrowdStrike, which supported the investigation, linked the activity to FAMOUS CHOLLIMA. The investigation remains ongoing, and the defendants are presumed innocent unless proven guilty.

A related FBI advisory warns that North Korean operatives are spreading devices across smaller laptop farms, recruiting financially distressed Americans, and outsourcing work and hiring activities to freelancers in South Asia and West Africa. The agency also reported data-leak extortion, death threats, paid in-person intimidation, and attempts to obtain identities suitable for security-cleared defense jobs. CrowdStrike assessed that the disruption would have limited, localized effects as operatives adapt. Employers should apply the FBI’s “identity in depth” approach: verify identities throughout employment, monitor suspicious remote access and device or applicant inconsistencies, and coordinate investigations across security, HR, and legal teams.