The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes.
In a case announced by the U.S. Attorney’s Office for the Northern District of Ohio, American nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under a four-count indictment involving wire fraud, money laundering and identity theft. The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang and others, while two additional defendants remain unidentified under seal.
According to prosecutors, the alleged scheme operated from 2019 until approximately July 2025. North Korean workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear to be Americans applying for jobs from within the United States. U.S.-based facilitators allegedly received company-issued laptops at their homes, configured the devices, installed remote-access software and helped transfer earnings to accounts controlled by North Korea.
The affected employers operated in sectors including healthcare, communications, cybersecurity support, retail and manufacturing.
The companies were located across Ohio, 16 other states and the District of Columbia.
Separately, the FBI carried out Operation Lonestar Roundup between September 21 and September 25, searching more than 40 residences in Texas suspected of hosting laptop farms. Investigators seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to facilitate fraudulent employment and revenue generation.
Cybersecurity company CrowdStrike has identified the network of North Korean workers and their helpers as “Famous Chollima.”
Investigators also identified fraudulent email accounts allegedly linked to the activity. The FBI has urged employers to add these addresses to their screening indicators and published a new public service announcement outlining detection and prevention measures.
Authorities warned that the schemes are evolving. North Korean workers are reportedly recruiting more American facilitators to evade improved corporate screening, assigning them additional responsibilities and, in some cases, subcontracting entire jobs to foreign nationals.
The latest actions form part of the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which targets illicit revenue operations and the people supporting them inside the United States.
Previous enforcement actions were announced in June and November 2025 and April and May 2026.
Officials have repeatedly warned that these workers can also use their access to steal sensitive company information or carry out data extortion. A 2022 advisory from U.S. agencies stated that individual North Korean IT workers could earn as much as $300,000 annually, contributing to hundreds of millions of dollars in collective yearly revenue.
The State Department has offered rewards of up to $5 million for information supporting efforts to disrupt North Korea’s illicit financial activities.
The Justice Department stressed that the allegations in the court documents have not been proven. All defendants are presumed innocent unless found guilty in court.
