Justice Department Takes Action Against North Korean IT Workers
Justice Department Takes Action Against North Korean IT Workers
Today, the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to Operation Lonestar Roundup, and the seizure of approximately 187 computer devices used by DPRK IT workers.
“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg. “These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft.”
Today, the U.S. Attorney’s Office for the Northern District of Ohio announced the arrests of U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas pursuant to a four-count wire fraud, money laundering, and identity theft indictment. The indictment describes a multi-year fraud scheme by Bostelle, Pena, and their co-conspirators to obtain remote IT work with U.S. companies that generated more than $3 million in revenue.
According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks, and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers issued by victim U.S. companies at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software, and transferred earnings to DPRK-controlled accounts. In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK.
Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement actions at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime’s sanctioned weapons programs.
U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima.” Investigators discovered that the DPRK operatives allegedly used a network of fraudulent email accounts to facilitate their criminal activity. Employers are encouraged to add these accounts to the list of indicators they use to identify and disrupt DPRK IT worker employment.
“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions.
These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere. North Korean IT workers have committed data extortion and exfiltrated proprietary and sensitive data from U.S. companies. North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s weapons programs.
For more details, check out the full article here: Read full article