Reported by 4 outlets
FBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.50 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 2.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.85 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 5.1 / 10 = base × recency + community
Desk analysis
Federal authorities in Texas have charged 14 people and seized 187 laptops in Operation Lonestar Roundup, the latest strike against North Korea's remote IT worker scheme. More than 40 Texas residences suspected of operating as laptop farms were searched. The farms housed employer-issued computers so North Korean engineers working abroad could access U.S. corporate networks under false identities, with U.S.-based facilitators configuring the devices and routing pay to regime-controlled accounts.
An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, alongside 10 others located in China. Prosecutors say the group held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities and collected about $3 million. CrowdStrike provided intelligence and technical analysis supporting the FBI's work. Prosecutors framed the case as counterproliferation as much as fraud, saying the revenue funds sanctioned weapons programs.
Hiring teams should treat this as confirmation that DPRK IT worker operations remain active at scale despite repeated takedowns. The tradecraft relies on complicit U.S. facilitators and identity fraud, so identity verification for remote hires and monitoring for anomalous laptop shipping and access patterns remain the practical defenses. Watch for further indictments and any CrowdStrike technical detail on the infrastructure behind these farms.
Timeline
-
original reporting
FBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies
malware.news · 7h ago · October 13th, 2026
The FBI searched more than 40 Texas residences and seized 187 laptops and other devices used to help North Korean operatives obtain remote jobs at U.S. companies under false identities, federal prosecutors announced Tuesday. The effort, dubbed Operation Lonestar Roundup, targeted “laptop farms” that housed employer-issued computers and allowed workers overseas to access them remotely. U.S.-based facilitators configured the devices and transferred earnings to North Korean-controlled accounts, according to the https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us?utm_source=chatgpt.com ”> Justice Department . CrowdStrike, which provided intelligence and technical analysis to support the FBI’s work, said the broader operation affected a campaign targeting more than 70 U.S. companies and included two arrests in Ohio. The company did not identify those arrested or describe the charges in its announcement to reporters. The Justice Department’s Texas release did not address the Ohio arrests. The scheme gave North Korean workers access to corporate systems while generating revenue for the regime’s sanctioned weapons programs, authorities sai
-
update from knowbe4.com
How a North Korean Fake IT Worker Tried to Infiltrate Us
knowbe4.com · 812d ago · July 23rd, 2024
KnowBe4 published a first-person account of nearly hiring an operative operating under a stolen US identity for a remote AI engineering role. The new hire attempted to load malware onto the company-issued laptop during onboarding, minutes after receiving it. The incident became the reference case for DPRK operatives seeking remote jobs at Western companies, predating this story by more than two years.
-
update from bleepingcomputer.com
US offers $5 million for info on North Korean IT worker farms
bleepingcomputer.com · 670d ago · December 12th, 2024
The State Department offered a reward of up to $5 million through its Rewards for Justice program for information that could disrupt the activities of North Korean IT worker farms. The offer, made in December 2024, framed the farms as revenue generation for the regime and invited reporting on facilitators inside the United States.
-
update from microsoft.com
Jasper Sleet: North Korean remote IT workers' evolving tactics to infiltrate organizations
microsoft.com · 470d ago · June 30th, 2025
Microsoft detailed the tactics of the Jasper Sleet activity set, its tracking name for DPRK remote IT worker operations, including the laptop farm model and the use of deepfakes in job interviews. The writeup documents how operatives convert a fraudulent hire into persistent access to the employer's environment and payroll.
-
update from therecord.media
US sanctions North Korea IT worker networks in Laos, Vietnam
therecord.media · 215d ago · March 12th, 2026
The US Treasury sanctioned North Korean IT worker networks operating out of Laos and Vietnam, targeting the overseas infrastructure that places operatives into remote jobs at Western companies. The action was part of a sustained enforcement run against the scheme through 2025 and 2026.
-
update from nknews.org
11 nations issue first-ever joint alert on North Korean IT worker schemes
nknews.org · 71d ago · August 3rd, 2026
Eleven nations jointly issued the first coordinated alert on North Korean IT worker schemes, warning companies about fraudulent remote employment pipelines.
-
update from malware.news
North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
malware.news · 8h ago · October 13th, 2026
Article Link: Internet Crime Complaint Center (IC3) | North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
-
update from www.justice.gov
In late September, 2026, CrowdStrike's Counter Adversary Operations team collaborated with the United States Federal Bureau of Investigation
www.justice.gov · 7h ago · October 13th, 2026
In late September, 2026, CrowdStrike's Counter Adversary Operations team collaborated with the United States Federal Bureau of Investigation
via Mastodon https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker
-
update from www.crowdstrike.com
(crowdstrike.com) Disruption of DPRK-Nexus FAMOUS CHOLLIMA Laptop Farms: A Coordinated Effort to Counter Fraudulent Employment and Cyber Thr
www.crowdstrike.com · 7h ago · October 13th, 2026
(crowdstrike.com) Disruption of DPRK-Nexus FAMOUS CHOLLIMA Laptop Farms: A Coordinated Effort to Counter Fraudulent Employment and Cyber Thr
via Mastodon https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/
-
update from cyberscoop.com
DOJ charges 14 over a sprawling North Korean remote work scheme
cyberscoop.com · 6h ago · October 13th, 2026
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad. An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. It alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay. An Ohio resident, Trey Michael Nolte, is also named as a co-conspirator in the indictment, but is not charged. Two unnamed defendants were also charged. “This investigation is about far more than fraud,” Ryan Raybould, a U.S. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States
-
mentioned by malware.news
The FBI dismantled a North Korean 'laptop farm' used to place fake remote workers inside US companies. The operation highlights a supply cha
malware.news · 6h ago · October 13th, 2026