The United States Justice Department on 14 October 2026 charged 14 individuals and arrested two in a sweeping crackdown on an alleged North Korean operation that infiltrated more than 70 American companies through fraudulent remote technology jobs, generating approximately $3 million believed to have been funnelled to the sanctioned Pyongyang regime. Federal agents simultaneously seized around 187 computers and related devices as part of the operation.

How the Scheme Worked

According to prosecutors, the operation ran from 2019 until around July 2025, with North Korean technology workers using fraudulent documents, virtual private networks, and other digital tools to conceal their identities and locations. American-based facilitators maintained employer-supplied computers at residential properties — arrangements investigators described as 'laptop farms' — allowing overseas workers to remotely access corporate systems while appearing physically present inside the United States.

The workers allegedly secured remote positions across multiple sectors, including healthcare, communications, cybersecurity support, retail, and manufacturing. Affected employers were located across Ohio, 16 other states, and Washington, DC.

Arrests, Indictment and Charges

Federal prosecutors in Ohio unsealed a 58-page indictment returned by a federal grand jury on 1 October, charging both American citizens and Chinese nationals with participating in the scheme. Two American nationals — Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas — were arrested in connection with the investigation.

Charges include conspiracy to commit wire fraud, money laundering, conspiracy to commit identity theft, and aggravated identity theft.

Operation Lonestar Roundup in Texas

In Texas, the FBI conducted targeted searches between 21 and 25 September under an initiative called Operation Lonestar Roundup. Investigators executed searches at more than 40 residences, seizing approximately 187 laptops and keyboard-video-mouse devices used to establish covert remote access to corporate computers. The FBI identified the network as Famous Chollima, a designation used by cybersecurity firm CrowdStrike.

What Officials Said

Assistant Attorney General for National Security John A. Eisenberg stated: 'North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies.'

US Attorney Ryan Raybould for the Northern District of Texas added: 'This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.'

The Broader Context

The Justice Department described the investigation as part of a wider effort to disrupt North Korea's illicit revenue-generating activities and prevent American companies from unwittingly supporting Pyongyang's weapons programmes. Notably, this is not the first such exposure — US authorities have previously flagged North Korean IT worker infiltration as a growing national security threat, with cybersecurity researchers estimating that hundreds of workers may still be embedded across Western firms. The scale of Tuesday's indictment, however, marks one of the most operationally detailed takedowns of such a network to date.