“This investigation is about far more than fraud,” U.S. Attorney Ryan Raybould said, framing the Justice Department’s latest move against a sprawling remote-work network alleged to benefit North Korea.
Operation Lonestar Roundup: arrests, seizures, and charges
Federal authorities announced an indictment unsealed in the Northern District of Ohio and executed searches in an operation the U.S. called Operation Lonestar Roundup. The Justice Department charged 14 people and seized roughly 187 computers after arrests and searches of more than 40 residences in Texas described as known or suspected “laptop farms.” Two arrests were reported. Two U.S. citizens—Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas—are charged in the indictment; Trey Michael Nolte of Ohio is named as a co-conspirator but is not charged. Two additional unnamed defendants were also charged.
What the indictment alleges: identities, payrolls, and infrastructure
Prosecutors allege the defendants and others located in China held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities and collected about $3 million in pay. The indictment details specific facilitator roles: Nolte allegedly kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. The DOJ said Bostelle provided his name and a fraudulent driver’s license to help a remote worker obtain a job, and Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers. Prosecutors also allege false employment records were filed with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity-theft victims.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechniques: laptop farms, paid U.S. intermediaries, and evolving tradecraft
The FBI released an updated advisory describing how the scheme has shifted as detection improved. Under pressure, North Korean workers now pay U.S. citizens to appear in interviews, take drug tests, access accounts, and keep company laptops running at home. Recruiters target people under financial strain. Some operators hire freelancers in Pakistan, India and Nigeria to perform the actual work, obscuring who is behind the job. The advisory recounts sharper tactics as well: threats against former managers after firings, demands for payment backed by stolen data, and paid helpers sent to intimidate companies in person.
CrowdStrike, which provided assistance to law enforcement, reported a recent technical change: since May the group has spoofed device identifiers, making a video capture card appear as a webcam, and reused the same disguised device across several jobs. The FBI warned that because these habits can resemble normal remote-work patterns, “no single warning sign catches them,” and called for layered checks throughout employment processes rather than blunt filters that would screen out qualified applicants.
FAMOUS CHOLLIMA and the 313 General Bureau: stated motives and U.S. response
U.S. and allied governments warned last month that a North Korean hacking group operating under the Munitions Industry Department’s 313 General Bureau is infiltrating tens of thousands of job seekers’ networks by posing as prospective employers—sometimes as AI firms—to steal sensitive data and millions in cryptocurrency. The stated intent is to circumvent economic sanctions that prevent the country from legally bankrolling its military ambitions. The State Department is offering rewards of up to $5 million for information that disrupts this scheme.
How CrowdStrike, the FBI, and affected groups are responding
- CrowdStrike: Adam Meyers, CrowdStrike’s head of counter adversary operations, told CyberScoop that while tradecraft may change, the adversary’s goal of evading sanctions remains. Meyers said disruption is critical: “Every laptop seized, every facilitator exposed, and every operation disrupted raises the cost of doing business for North Korea.” CrowdStrike also cautioned that a single takedown is unlikely to have a lasting operational effect but signals visibility into the adversary’s infrastructure.
- FBI and U.S. law enforcement: the FBI issued an advisory describing the evolving tactics and urging layered employment checks rather than blunt filters, because conventional indicators can look like legitimate remote work.
- Affected companies and recruiters: the advisory and indictment highlight the need to scrutinize identities, interview processes, device identifiers and backend account access after hires—measures the FBI recommended to reduce exploitation while avoiding exclusion of legitimate candidates.
Raybould framed the operation in national-security terms: “Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.” Yet the public record in this action contains both resolute prosecution and sober realism: law enforcement and private partners celebrate the takedown and visibility it provides, while CrowdStrike warns disruption alone is not a durable solution. As the indictment alleges the scheme paid out roughly $3 million from 2019–2025 and facilitators moved six-figure sums through false accounts, the immediate question for investigators and employers alike is whether layered detection and repeated disruption can outpace an adversary that keeps changing its tradecraft.
Source: CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme
