--- title: "DOJ Indicts 14 in North Korean Remote IT Scheme Hitting Over 70 US Firms" description: "Federal authorities arrested two US facilitators and raided Texas laptop farms in an operation tied to $3 million in illicit regime revenue." url: https://basisdesk.news/news/doj-indicts-north-korea-remote-it-worker-scheme published: 2026-10-13T19:31:34.791Z modified: 2026-10-13T19:31:34.791Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [] tags: [cybersecurity, doj, fbi, north-korea, fraud, sanctions] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # DOJ Indicts 14 in North Korean Remote IT Scheme Hitting Over 70 US Firms Federal authorities arrested two US facilitators and raided Texas laptop farms in an operation tied to $3 million in illicit regime revenue. ## At a glance - **What happened:** The US DOJ charged 14 people and seized 187 devices tied to North Korean remote IT workers who infiltrated over 70 US firms. - **Why it matters:** The scheme generated about $3 million for sanctioned DPRK entities by exploiting stolen identities and domestic laptop farms. - **Who is affected:** US employers in healthcare, communications, retail, manufacturing, and cybersecurity sectors. - **What's next:** Court proceedings for two arrested US defendants in Ohio and corporate deployment of FBI identity-verification guidelines. - **Status:** enforcement - **Primary source:** [Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker) — U.S. Department of Justice ## Key points - DOJ charged 14 individuals after DPRK remote IT workers defrauded more than 70 US firms of $3 million between 2019 and July 2025. - FBI executed Operation Lonestar Roundup across 40 Texas residences, seizing roughly 187 laptops and KVM switching devices. - US facilitators hosted employer laptops in residential farms to route foreign remote connections through domestic IP addresses. ## Editorial remark - **Context:** The action is part of the federal 'DPRK RevGen: Domestic Enabler Initiative,' which previously executed enforcement operations in June 2025, November 2025, April 2026, and May 2026 to sever illicit overseas revenue streams. - **Impact:** US corporate employers face elevated regulatory scrutiny and operational risks regarding remote hiring procedures, identity vetting, and internal network hardware controls. - **Watch:** Corporate implementation of the FBI's newly published mitigation indicators and further court appearances for the two arrested US facilitators in Ohio federal court. The US Department of Justice announced coordinated enforcement actions on Oct. 13 targeting illicit remote IT worker schemes operated on behalf of the Democratic People’s Republic of Korea (DPRK) [1]. Federal authorities unsealed an indictment charging 14 individuals, arrested two US nationals, and raided dozens of domestic proxy locations designed to disguise foreign workers inside American corporate networks [1]. Prosecutors in the Northern District of Ohio arrested US citizens Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on charges of wire fraud, money laundering, and identity theft [1]. Ten China-based individuals were also charged, alongside two unnamed defendants whose identities remain sealed [1]. Investigators alleged that between 2019 and approximately July 2025, overseas operatives used stolen US identities and domestic facilitators to secure remote contracts, siphoning roughly $3 million to sanctioned DPRK-linked entities [1]. Impacted employers spanned over 70 domestic firms across healthcare, cyber support, communications, manufacturing, and retail sectors in 17 states and Washington, D.C. [1]. ## Operation Lonestar Roundup Between Sept. 21 and Sept. 25, federal agents executed searches across more than 40 residential sites in Texas as part of "Operation Lonestar Roundup" [1]. The coordinated sweep resulted in the seizure of approximately 187 laptops and KVM hardware units [1]. US-based collaborators allegedly used the hardware to operate "laptop farms," hosting employer-issued equipment locally and running remote-desktop software so North Korean workers could mask their locations [1]. According to cybersecurity firm CrowdStrike, which assisted federal investigators, the tracked cluster operates under the moniker "Famous Chollima" [1]. The FBI concurrently issued a public service announcement outlining mitigation steps and published multiple fraudulent email addresses tied to the campaign [1]. Officials cautioned that DPRK networks increasingly recruit US-based intermediaries to bypass enhanced corporate identity verification tools [1]. ## Sources 1. [Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker) — U.S. Department of Justice, 2026-10-13 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai