About 187 computers were seized and more than 40 so‑called "laptop farms" in Texas were dismantled, part of a U.S. criminal case that charges 14 people in a multi‑year scheme to conceal North Korean IT workers as legitimate remote employees of American companies.
U.S. Department of Justice: charges, seizures, and named defendants
The U.S. Department of Justice charged 14 people and seized roughly 187 computers as part of an operation tied to a long‑running fraud that targeted employers in the United States. The indictment alleges wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft in a scheme that affected more than 70 U.S. companies and generated approximately $3 million in revenue for IT workers.
The indictment lists a mix of U.S. citizens and Chinese nationals. The individuals named are:
- Sun Sheng Ming, 37, Dandong City, China
- Pei Li Guang, age unknown, Liaoning, China
- Weng Shou Cheng, age unknown, Liaoning, China
- Han Guo Bin, age unknown, Dandong City, China
- Wang Jian Jun, 34, Dandong City, China
- Sheng Zhang Kun, age unknown, Shenzhen, China
- Zhang Wei Ping, age unknown, Dandong City, China
- Zhang Li Ping, age unknown, unknown location
- Yu Yang, 40, age unknown, Dandong City, China
- Jin Long, 35, unknown location
- Michael James Bostelle, 31, Philadelphia, Pennsylvania
- Juan Cecilio Pena Carrillo, 37, San Juan, Texas
The two U.S. nationals, Carrillo and Bostelle, have been arrested; the remaining defendants are described as at large. Another U.S.‑based co‑conspirator, Trey Michael Nolte, is named in the indictment but was not charged; court documents allege Nolte managed a shell company called Dark Falls LLC that claimed to offer software development services but was used to perpetrate the scheme.
U.S. Attorney David M. Toepfer for the Northern District of Ohio commented: "Threats posed by nation‑states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation's economic strength to further and fuel their own nefarious agendas."
Famous Chollima / purpledelta / Wagemole: the operational model
Court documents say the operation—tracked under names including Famous Chollima, purpledelta, and Wagemole—ran from about 2019 until July 2025. According to the indictment, North Korean IT workers were hired at U.S. and other companies using fake identities, drew regular salaries, and funneled a portion of pay back to the government of the Democratic People's Republic of Korea in violation of international sanctions to fund "its nuclear weapons and other military programs."
Facilitators in the United States are accused of several enabling functions: helping workers get hired, hosting employer‑issued laptops at U.S. residences, using remote‑access technology to make overseas workers appear as U.S.‑based employees, and setting up accounts at U.S. banks and online money‑transfer services to move employer payments abroad. Facilitators received fees in return for these services.
Your town's IT department is one person. Maybe.
Ransomware crews target small municipalities because nobody's watching. Nubivance gives Maine and New Hampshire towns a security program sized to a town budget.
Protect the town officeCrowdStrike on laptop farms and evasive device tactics
Security firm CrowdStrike, which investigated incident indicators tied to suspected fake IT workers, described how operatives directed employer‑provided hardware to laptop‑farm addresses during onboarding. Observed techniques included filing fraudulent police reports to trigger replacement shipments to farm addresses, rotating residential addresses to obscure final destinations, claiming last‑minute relocations to divert devices mid‑shipment, and leveraging IT staffing firms to quietly redirect end‑client devices.
Since at least May 2026, CrowdStrike said, Famous Chollima has spoofed device hashes—for example, mimicking a video capture card to appear as a webcam—likely to hide tools' use and evade detection. CrowdStrike summarized the role of farms and facilitators as serving "a rented U.S. footprint: a physical address, a legal identity, and a mechanism to satisfy 'know your client' regulations," while cautioning that "this disruption will likely slow Famous Chollima's operations only in the immediate areas where the laptop farms were shut down and is unlikely to create long‑lasting effects."
FBI alert: expanded facilitator networks and coercive tactics
The FBI issued an alert describing the scheme's growing reliance on facilitators and the subcontracting of work. The bureau said North Korean IT workers increasingly obtain jobs with Western companies and then hire freelancers in countries such as Pakistan, India, and Nigeria to complete assignments for a fraction of the salary. Freelancers have also been paid to apply for positions or to conduct interviews on behalf of IT workers.
The FBI further reported that operatives have used stolen identities, falsely claimed ownership of social media and professional profiles, pursued positions requiring U.S. government security clearances, and targeted cleared defense contractors and active‑duty U.S. military members to host laptops. In some cases, the FBI said, threat actors used threats of physical violence against former managers and their families to demand payments or coerce actions that furthered the scheme.
What this means for technologists, policymakers, and affected employers
- Technologists and security teams should watch for device‑level anomalies described by CrowdStrike—spoofed device hashes and redirected endpoints during onboarding—that may indicate an illicit "rented U.S. footprint."
- Policymakers and regulators will face a question identified in the case: whether disrupting physical hosting nodes in a single state suffices, given the FBI and CrowdStrike warnings that facilitators can subcontract and route around localized takedowns.
- Affected employers and procurement leaders must be aware that more than 70 U.S. companies across sectors including health care, communications, cyber support, retail, and manufacturing—and spread across at least 20 states and the District of Columbia—were cited as victims, underscoring the cross‑industry reach of the scheme.
The indictment and the wide array of operational details from CrowdStrike and the FBI together underscore both a tangible disruption—seizures and raids across Texas—and an open question about durability: will removing more than 40 laptop farms and 187 devices significantly dent an adversary the DOJ alleges adapted by rotating addresses, subcontracting work internationally, and spoofing device identifiers? CrowdStrike's own assessment suggests the operation will evolve, leaving enforcement and detection strategies to chase changing tradecraft.
