Fourteen Charged in Multi-Year North Korean IT Scheme Generating Three Million Dollars
Federal law enforcement authorities announced coordinated actions against North Korean government schemes that funneled remote information technology workers into U.S. companies to finance the regime’s weapons programs, justice.gov reported. The U.S. Department of Justice unsealed an indictment charging 14 individuals, executed two arrests, and seized approximately 187 computer devices across more than 40 suspected laptop farms in Texas during an operation dubbed “Operation Lonestar Roundup.”
Indictment Details Multi-Year Wire Fraud Involving U.S. Facilitators
The U.S. Attorney’s Office for the Northern District of Ohio announced arrests for U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Court documents outline a multi-year fraud scheme running from 2019 through July 2025, where North Korean IT workers used stolen or fabricated identity documents to secure remote positions. The network also included ten China-based defendants: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long.
🚨 Today, the @FBI and @TheJusticeDept announced a series of coordinated actions against the North Korean IT Worker threat – securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected “laptop farms”… pic.twitter.com/GmBjBaSUGs
By relying on virtual private networks and proxy infrastructure, the workers appeared as U.S. persons operating domestically. Domestic facilitators hosted company-issued laptops at residential “laptop farms,” configured the hardware, installed remote-access software, and routed earnings to North Korean-controlled accounts. The operation impacted more than 70 employers across health care, communications, cyber support, retail, and manufacturing sectors in Ohio and 16 other states.
Operation Lonestar Roundup Dismantles Texas Laptop Farms
Between Sept. 21 and Sept. 25, the FBI searched more than 40 residences in Texas operating as laptop farms. Cybersecurity firm CrowdStrike identified the participating North Korean operatives under the moniker “Famous Chollima.” Investigators traced the criminal activity through a network of fraudulent email addresses, including Bright.star.me208@gmail.com, randyryang@gmail.com, and michaelb860102@gmail.com. Federal officials urged employers to incorporate these identifiers into screening protocols to prevent infiltration.
The enforcement effort forms part of the broader DPRK RevGen: Domestic Enabler Initiative, a joint project between the National Security Division and FBI Cyber and Counterintelligence Divisions. Assistant Attorney General for National Security John A. Eisenberg stated that the revenue generated by these IT worker schemes funds illicit weapons development targeting the United States and its allies. The U.S. Department of State maintains a rewards program offering up to $5 million for information disrupting North Korean financial schemes and sanctions evasion.
Frequently Asked Questions
What specific security risks do North Korean remote IT workers pose to U.S. employers?
Beyond generating illicit revenue for sanctioned weapons programs, North Korean remote IT workers use stolen identities and covert access points to commit data extortion and exfiltrate proprietary data from company networks, according to a Public Service Announcement issued by the FBI.
How much revenue did the indicted network generate through fraudulent IT employment?
The four-count indictment filed in the Northern District of Ohio details a scheme that generated more than $3 million in revenue across more than 70 victim employer companies.
What official charges do the defendants face in federal court?
The indictment filed by the U.S. Attorney’s Office for the Northern District of Ohio charges the defendants with wire fraud, money laundering, and identity theft. All defendants remain presumed innocent until proven guilty in a court of law.
Related reading