FBI Disrupts North Korean IT Worker Schemes, Arrests US Nationals

“the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure,” CrowdStrike said, after a multi-day FBI sweep in Texas seized nearly 187 laptops tied to a North Korean remote IT worker network.

FBI "Lonestar Roundup" searches 40 residences in Texas

Between September 21 and 25, the FBI executed searches at 40 residences in an operation codenamed "Lonestar Roundup," targeting locations suspected of hosting laptop farms used by the Famous Chollima threat group (also tracked as WageMole). Law enforcement seized approximately 187 laptops and KVM input devices from those sites, part of an effort the U.S. Department of Justice describes as disrupting Famous Chollima’s operations.

The seized hardware: employer-issued laptops and KVMs

Authorities recovered roughly 187 laptops and KVM input devices that, according to public filings and cybersecurity reporting, were used to give DPRK-based remote IT workers access to employer-issued machines while appearing to be U.S.-based. CrowdStrike has been tracking Famous Chollima activity since April 2025 and flagged these laptop-farm techniques as a core component of the group’s revenue-generating schemes.

How Famous Chollima masked remote workers and diverted devices

CrowdStrike and DoJ filings describe a set of recurring tactics used by DPRK operatives and their U.S.-based facilitators to place company laptops onto farm infrastructure rather than into the hands described by submitted identity documents. Methods cited in the reporting include:

• submitting fake theft reports to trigger replacement shipments to a farm’s address;
• rotating through residential addresses to obscure the final destination;
• claiming last-minute relocations to divert devices mid-shipment;
• abusing IT staffing roles to covertly redirect employer devices.

The operators also used stolen or fabricated identities, VPNs, and proxy infrastructure to appear U.S.-based, while American facilitators hosted the company-issued laptops, installed remote‑access software, and transferred earnings to DPRK-controlled accounts. CrowdStrike reported that public exposure has pressured operatives to rely more on spoofing device identifiers or even reusing identifiers across victim organizations.

Ohio indictment: scale, timeline, and criminal charges

The Department of Justice published an Ohio indictment describing a remote IT workers scheme that ran from 2019 to July 2025. That filing says the scheme impacted 70 companies in the United States and generated roughly $3 million for the North Korean threat actors. As part of the disruption, authorities have charged 14 individuals in total and arrested two U.S. nationals—Michael James Bostelle and Juan Cecilio Pena Carrillo—on counts that include wire fraud, money laundering, and identity theft. The DoJ also announced similar charges against 12 Chinese defendants tied to the broader activity.

What this means for technologists, policymakers, and affected enterprises

• Technologists and security teams: expect increased scrutiny on device identifier spoofing and identifier reuse, techniques CrowdStrike says operators have leaned on after public exposure. Teams will need to validate device provenance and remote‑access behaviors tied to employer assets.
• Policymakers and regulators: the operation underscores law enforcement activity against networks that help sanctioned states monetize access to global technology employment. The DoJ indictment and criminal charges show a combined legal and investigative response to schemes that use fabricated identities and intermediaries to evade sanctions and controls.
• Affected enterprises and procurement leaders: the case highlights the concrete risk of redirected shipments, fake theft reports, and last‑minute relocation claims tied to onboarding or equipment replacement processes. Company‑issued laptops remain a vector both for illicit remote access and for financial flows to distant actors when intermediaries host those devices.

CrowdStrike cautioned that actions like Lonestar Roundup are unlikely to eliminate the problem entirely but framed the Texas operation as a starting point for broader enforcement. The arrests, the seized hardware, and the Ohio indictment together provide the first public record tying laptop‑farm infrastructure to a multi‑year scheme that moved millions of dollars and affected dozens of U.S. companies. Whether this disruption will materially reduce Famous Chollima’s ability to place DPRK workers at scale remains the central question left by the filings—and the Justice Department’s next steps will be the clearest indicator of how thoroughly U.S. infrastructure tied to the group can be dismantled.

Source: BleepingComputer — FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested