DOJ Arrests Two US Nationals in North Korean Laptop Farm Raid
Federal agents raided 40 Texas homes, seizing 187 devices linked to a $3 million North Korean IT worker fraud scheme.
Key points
- Two US nationals were arrested and indicted for facilitating North Korean IT worker fraud.
- Law enforcement seized 187 laptops from 40 residences in Texas during September raids.
- The scheme generated over $3 million from approximately 70 US companies across 17 states.
The Department of Justice arrested two US nationals and indicted several others for their roles in a North Korean IT worker scheme that generated more than $3 million in fraudulent revenue. The operation, which included raids on more than 40 residences in Texas between September 21 and 25, targeted laptop farms used to mask the location of remote workers.
Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were charged with wire fraud, money laundering, and identity theft. According to prosecutors, these individuals helped North Korean nationals secure remote IT roles by providing housing for company-issued laptops and assisting with fake identification documents. The indictments also name several Chinese nationals as co-conspirators in the multi-year fraud.
Operational Details of the Scheme
The fraudulent operation, tracked by cybersecurity firm CrowdStrike as Famous Chollima, relied on US facilitators to host and configure laptops issued by victim companies. This setup allowed North Korean IT workers to appear as if they were working from within the United States. From 2019 to July 2025, the scheme reportedly involved the use of fake IDs, VPNs, and proxy infrastructure to hide the true locations of the workers.
Law enforcement seized 187 laptops and KVM devices during the raids, known as Operation Lonestar Roundup. These devices were used to commit fraud and maintain the illusion of domestic employment. The DOJ stated that the laptops were housed by Bostelle and Pena, who helped IT workers obtain and use fraudulent identification to verify bank accounts and secure employment.
Impact on US Organizations
The indictment alleges that the scheme targeted approximately 70 US companies across 17 states, including organizations in healthcare, cybersecurity, retail, and manufacturing. Assistant Attorney General John Eisenberg stated that such schemes threaten the security of IT systems and data of deceived employers while leaving countless victims of identity theft. The revenue generated is allegedly used by the North Korean regime for illicit purposes, including weapons development.
Trey Michael Nolte, a US national not charged in the case, is central to the indictment. Prosecutors allege he ran a shell company that facilitated the scheme, recruited Bostelle, and laundered paychecks earned by the IT workers back to North Korea. The DOJ did not explain why Nolte was not charged alongside the arrested suspects.
What should you do?
Organizations should review their remote hiring processes to ensure strict verification of employee identities and physical locations. IT teams should monitor for unusual device behavior, such as spoofed device hashes or remote access tools that do not match expected configurations. Companies should also audit their shipping and logistics records for discrepancies in device delivery addresses.
What to do and how to stay safe: North Korea
- Verify the physical location of remote employees through multiple independent methods, not just IP addresses or self-reported data.
- Monitor network traffic for signs of remote access tools or proxy usage that could indicate a worker is not at the claimed location.
- Audit hardware inventory and shipping logs to ensure company devices are delivered to and used at verified employee addresses.
- Implement strict identity verification protocols during the hiring process to detect fraudulent documentation or stolen identities.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who were the individuals arrested in this operation?
The Department of Justice arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas for their roles in the IT worker scheme.
How much revenue did the scheme generate?
Prosecutors stated that the scheme generated more than $3 million in fraudulent revenue from approximately 70 US companies.
What devices were seized during the raids?
Law enforcement seized 187 laptops and KVM devices from more than 40 residences in Texas during the September raids.
