American computers, employees under false identities. The United States Department of Justice announced on October 13 coordinated actions against networks of North Korean computer scientists working remotely for American companies. The toll includes 14 people charged, two arrests and around 187 devices seized. Authorities accuse these networks of using stolen identities and local relays to generate revenue for Pyongyang.
A court filing in Ohio targets a scheme that affected more than 70 employers and generated around $3 million.
In Texas, Operation Lonestar Roundup targeted more than 40 homes and led to the seizure of computers and control boxes.
The authorities are warning of the growing role of American intermediaries in this recruitment fraud.
According to the indictment presented in Ohio, the device allegedly operated from 2019 until around July 2025. North Korean computer scientists used stolen or fabricated identity documents to obtain positions with American companies. VPNs and proxy infrastructures helped make them appear to be workers based in the United States.
Two American nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested. The indictment also targets ten people established in China and two others whose identity remains confidential. The charges relate in particular to electronic fraud, money laundering and identity theft.
The American relays would have received the computers provided by the employers, then configured them to allow their remote use. These domestic installations, nicknamed “laptop farms”, served as local access points for workers operating from abroad.
The facilitators also allegedly participated in the transfer of remuneration to accounts controlled by North Korea. According to prosecutors, the scheme generated approximately $3 million, the alleged recipients of which were sanctioned entities linked to the regime.
More than 70 employers are affected in health, communications, IT support, distribution and industry. They are distributed between Ohio, sixteen other states and the District of Columbia. The accusations remain to be established in court; Defendants benefit from the presumption of innocence.
A second part concerns Operation Lonestar Roundup. From September 21 to 25, the FBI conducted searches and other interventions at more than 40 Texas residences known or suspected of housing facilities used by North Korean workers.
Agents seized approximately 187 laptops and KVM devices, intended for controlling the machines. This total therefore does not correspond to only 187 computers. CrowdStrike, which collaborated with investigators, refers to the group as Famous Chollima.
The goal is to remove the American infrastructure that makes these fraudulent jobs possible. The physical presence of a computer in the United States does not guarantee that the person using it resides there, nor that they match the identity presented during recruitment.
The authorities also describe an adaptation of the methods. Faced with the strengthening of controls, operators are recruiting facilitators for more varied tasks and sometimes subcontracting entire positions to other foreign nationals.
The press release publishes eleven email addresses associated with the identified devices and links to a new FBI alert. He also recalls that these infiltrations can expose companies to the theft of sensitive data and extortion, beyond the payment of salaries under a fraudulent identity.
