DOJ charges 14 over North Korean remote IT worker scheme
Fake identities placed North Korean IT workers at more than 70 US companies. Two people were arrested and agents searched homes in Texas.
The US Department of Justice (DOJ) charged 14 people with helping North Korea place technology workers as remote employees at American companies, according to a DOJ announcement dated Oct. 13, 2026. Two of the defendants were arrested and 10 more are based in China. The identities of the remaining two are sealed.
The indictment, filed in the Northern District of Ohio, has four counts: wire fraud, money laundering and identity theft. It covers 2019 to about July 2025. The two people in custody are Michael James Bostelle, a Pennsylvania resident, and Juan Cecilio Pena Carrillo, of Texas. The charges are allegations: no one has been found guilty, and the defendants are presumed innocent.
How it worked
According to the DOJ, the workers used stolen or invented identities, virtual private networks (VPNs) and proxy servers to appear to be working from the United States. Facilitators inside the country received company laptops at their homes, set them up and installed remote-access software. Investigators call these homes "laptop farms."
BleepingComputer adds that some operators filed false theft reports so that employers would ship replacement equipment to those addresses.
The DOJ's numbers
| Item | Figure |
|---|---|
| Companies affected | more than 70 |
| Revenue generated | about $3 million |
| Homes searched in Texas | more than 40 |
| Devices seized | about 187 |
| State Department reward | up to $5 million |
The searches, known as Operation "Lonestar Roundup," took place from Sept. 21 to 25, weeks before the announcement. The DOJ did not say whether they are connected to the two arrests in Ohio. The FBI also issued a public advisory with mitigation guidance for businesses.
Neither the DOJ announcement nor the FBI advisory cites companies or people in Mexico. According to BleepingComputer, the security firm CrowdStrike, which has tracked the group as "Famous Chollima" since April 2025, sees the operation as the start of a broader effort against its US infrastructure. Court dates for the two arrested defendants have yet to be set.
