The Justice Department on Tuesday announced charges, arrests and device seizures against a North Korean remote IT worker operation that, by DOJ's count, landed jobs at more than 70 U.S. companies. The FBI's Cyber Division says the coordinated actions charge 14 individuals. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on a four-count wire fraud, money laundering and identity theft indictment out of the Northern District of Ohio. Ten China-based defendants are named in the same indictment, and two more remain under seal (per DOJ).
The numbers. The indictment says the scheme ran from 2019 to about July 2025 and generated about $3 million in revenue that is believed to have gone to sanctioned DPRK-controlled entities. Victim employers sit in health care, communications, cyber support, retail and manufacturing, across Ohio, 16 other states and the District of Columbia. Separately, under Operation Lonestar Roundup, the FBI searched more than 40 Texas residences between Sept. 21 and Sept. 25 that it knew or suspected were laptop farms, and seized about 187 laptops and KVM devices over the whole operation (per DOJ). About 100 of those devices came out of North Texas (per Nextgov/FCW). Reuters reports the scheme compromised the identities of 25 Americans. Victim company names: Undisclosed.
How it worked. Workers applied with stolen or fabricated identity documents, then used VPNs and proxy infrastructure to look like they were working from inside the U.S. Facilitators at home received company-issued laptops, set them up, installed remote-access software, and sent the pay on to DPRK-controlled accounts (per DOJ). CrowdStrike, which gave the FBI intelligence and technical analysis, tracks this group as Famous Chollima. The FBI's new public service announcement adds something defenders should note: these crews now hire American facilitators for a wider range of tasks to get around better private-sector detection, and in some cases subcontract entire jobs to other foreign nationals.
Why buyers should care. This isn't only a sanctions story. Earlier FBI advisories describe North Korean IT workers stealing proprietary data and extorting employers once they're inside, and in a case announced last year, prosecutors said a worker took export-controlled technical data from a California defense contractor (per Nextgov/FCW). One of the victim sectors listed here is cyber support. The person with admin on your tenant could be the one on the indictment.
What we'd do this morning. Take the 11 Gmail addresses DOJ published and search your applicant tracking system, HR records and IdP for them. Then hunt the laptop farm pattern on your own fleet. Look for remote-access tools your IT team didn't install, like AnyDesk, TeamViewer, Chrome Remote Desktop or RustDesk, on corporate endpoints. Look for KVM or IP-KVM USB device IDs in EDR telemetry, and for a single residential IP or ISP block shared by several "different" employees. Look for VPN egress that moves around while the payroll address stays put. Ship laptops only to the address on verified ID, and run a live camera check before a new remote engineer gets prod access. A hire who never turns on a camera and keeps changing where their paycheck goes is the cheapest signal you'll get.