North Korean IT worker laptop farms raided, two arrested

US authorities have arrested two men and searched more than 40 suspected "laptop farms" in a crackdown on schemes that let North Korean IT workers draw salaries from American companies. According to the US Department of Justice, the workers used stolen and fabricated identities to get remote jobs at more than 70 US firms.

A laptop farm is a home or other location inside the US where company-issued computers are kept switched on and connected. This lets workers abroad log in remotely while appearing to be based in the country.

Two men in custody under Ohio indictment

Michael James Bostelle, from Pennsylvania, and Juan Cecilio Pena Carrillo, from Texas, were arrested under an indictment filed in Ohio. They face charges of wire fraud, money laundering and identity theft. The same indictment names ten defendants based in China. Two more defendants have not been publicly identified because their identities remain under seal.

Prosecutors say the scheme ran from 2019 until around July 2025. During that period, the two men and their co-conspirators allegedly received laptops that victim companies had issued to their supposed employees. They installed remote-access software on the devices and then moved the wages, roughly $3 million, to accounts controlled by North Korea.

The affected companies work in health care, communications, retail and manufacturing. They are spread across 17 states and the District of Columbia.

Operation Lonestar Roundup

Separately, FBI agents in Texas searched more than 40 suspected laptop farms between September 21 and 25. The action, called Operation Lonestar Roundup, led to the seizure of about 187 laptops and KVM devices. KVM (keyboard, video, mouse) switches allow one person to control several computers from a single set of peripherals.

Ryan Raybould, the U.S. Attorney for the Northern District of Texas, said the case went beyond simple fraud.

"It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability," he said.

CrowdStrike helped the FBI disrupt the operation. The US security company tracks the North Korean workers and the people who assist them under the name "Famous Chollima."

In a blog post, CrowdStrike explained why the farms matter so much to the group. It said they solve "physical, financial, and legal" problems that the operatives cannot easily handle from outside the country. Without someone on US soil, the company noted, the workers could not receive and set up employer hardware, get around geolocation-based fraud checks, or pass the identity verification steps that stand between applicants and real jobs.

Paid helpers and extortion threats

The FBI published a public service announcement on the same day. It said most names and addresses the workers give employers belong to real people. Some of the operatives landed roles with access to sensitive personal data. They stole that data and used it in their schemes, and in isolated cases tried to extort the people it belonged to.

The bureau also said the workers are paying more and more Americans to help them. These helpers appear on camera, sit in job interviews, verify fake identities, hand over their social media or professional networking accounts, or ship packages. According to the FBI, the operatives "strategically target those under financial stress."

"These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny," the FBI warned.

The agency described more aggressive behavior as well. After being fired, some workers sent death threats to former managers and their families. Others threatened to leak corporate data unless they were paid. The FBI estimates that 85-90% of the money the workers earn goes to the North Korean government.

A growing list of cases

The arrests add to a series of US prosecutions of people who supported these schemes. In November 2025, five men admitted to helping North Korean IT workers get hired at US companies. In April 2026, two men from New Jersey were sentenced to nine years and nearly eight years in prison for their part in a scheme that earned $5 million for North Korea.

Researchers have also reported that suspected North Korean workers have moved beyond IT into sales, marketing and healthcare roles.

Our Take

This case shows that the North Korean remote-worker problem depends on people inside the target country. The workers can fake names and resumes from abroad, but they still need someone to plug in a laptop, receive a package or sit in front of a webcam. That makes the local helper network the weakest link, and the FBI appears to be focusing on it, much like other recent cases against money mule operations that move criminal proceeds.

For employers, this is an insider risk that starts at the hiring stage. It fits a wider pattern of attackers placing their own people inside organizations instead of breaking in from outside. The reported threats against former managers suggest that simply firing a suspected worker may not end the risk.

It is worth watching whether the move into sales, marketing and healthcare roles pushes companies to apply stricter identity checks to jobs that were not seen as sensitive before.