Two US nationals have been arrested for allegedly helping North Korean IT workers obtain remote jobs at American companies through a multi-year fraud scheme that generated more than $3 million.
Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas are accused of helping North Korean workers hide their real locations and appear to be working from the United States. According to a four-count indictment, the scheme ran from 2019 to July 2025 and affected more than 70 US companies.
The suspects allegedly hosted and configured company-issued laptops at US locations, allowing overseas workers to access them remotely. The workers used fake identities, VPNs and proxy services to hide their locations and secure jobs in several industries.
In a separate operation called Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of operating as laptop farms. Police officers seized 187 laptops and KVM devices allegedly used to support the scheme.
The indictment also names 10 China-based individuals accused of taking part in the operation.
Cybersecurity firm CrowdStrike, which tracks the North Korean activity as Famous Chollima, says that IT workers (ITWs) based overseas use various tactics to persuade employers to ship company-issued laptops to designated laptop farms, including fake police reports claiming that laptops have been stolen and need replacement, citing unexpected relocations to redirect shipments, using multiple residential addresses, and relying on IT staffing firms during recruitment.
Once the devices arrive, US-based facilitators install hardware and software that allow ITWs to access and operate the laptops remotely.
In a recent alert, the FBI has warned that ITWs are increasingly using intermediaries and US nationals to obtain jobs and avoid detection. They often use remote access software, install unrelated applications, steal data, change bank accounts and addresses, and submit fake identity documents. The FBI advises organizations to use multiple security checks and layered access controls to identify suspicious activity throughout the hiring and employment process.