WASHINGTON — Fourteen people have been charged in a remote IT work scheme that federal prosecutors say steered about $3 million to North Korea, and agents in Texas have seized about 187 laptops and other devices from homes used as “laptop farms.”
Tuesday’s announcement from the Justice Department pulled several cases together at once. In Ohio, a 58-page indictment came out from under seal. Two men were arrested. And in Texas, agents had already searched more than 40 homes, between Sept. 21 and Sept. 25.
The company list runs past 70 names, and it is not regional. Department officials count victims in Virginia and Maryland, and in the District of Columbia too.
Prosecutors say the workers were not in the United States at all. Using stolen or made-up identity documents, VPNs and proxy servers, North Korean IT workers took remote jobs while appearing to work from inside the country, the indictment alleges.
The laptops made the fiction work. Companies mailed computers to facilitators in the United States, who kept them at home, set them up and installed remote-access software. Pay then moved on to accounts controlled by the Democratic People’s Republic of Korea, prosecutors say.
Two U.S. citizens are among the defendants. Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas, have been arrested and are expected to appear in court in the Northern District of Ohio.
The other named defendants are based in China. They remain at large, and two more defendants are still under seal.
The indictment is built mostly on conspiracy charges — wire fraud and money laundering among them — with identity theft counts on top, one of them aggravated. It reaches back to 2019. The work, prosecutors say, was still going on in July 2025.
In Texas, the FBI operation had its own name: Operation Lonestar Roundup. About 100 of the seized devices were in North Texas alone. The cybersecurity firm CrowdStrike calls the group behind this activity “Famous Chollima,” the Justice Department said.
“This investigation is about far more than fraud.”
In the same statement, Raybould said a hostile regime had used stolen identities and access points inside U.S. borders to get into American companies.
The employers are a mixed group: health care, communications, cyber support, retail, manufacturing. Some sit in Ohio. Sixteen other states have them too, along with the capital.
Employers are being told to change how they check. The FBI put out a public service announcement on Tuesday with ways to spot the scheme, noting that North Korean workers now recruit American facilitators for more kinds of tasks and sometimes subcontract whole jobs to third-country nationals.
The State Department is offering rewards of up to $5 million for information that helps disrupt North Korea’s illicit financial activity, including cybercrime and sanctions evasion.
An indictment is a charge, not proof. The defendants are presumed innocent unless the government proves guilt beyond a reasonable doubt.
