40 homes searched in Texas. 187 devices seized.
Between September 21 and 25, FBI agents searched more than 40 residences across Texas suspected of operating as “laptop farms” in an operation the Justice Department calls Operation Lonestar Roundup. They seized roughly 187 laptops and KVM devices.
Separately, the Justice Department unsealed an indictment from the Northern District of Ohio. Two Americans were arrested, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, on charges of wire fraud, money laundering, and identity theft. Ten China-based operatives were charged in the same indictment, and two additional defendants remain under seal. In total, 14 individuals face charges, according to the FBI.
How the con worked
The North Korean operatives did not hack their way into these companies. They applied for jobs. Using the stolen identities of 25 Americans, they posed as legitimate remote IT workers, complete with real-looking email addresses. When a company hired them and shipped a laptop, the machine went to a facilitator’s home in Texas, not to the supposed employee.
The facilitators handled the physical side. They received the laptops, kept them powered on and connected, and made it look as though the employee was working from inside the United States. The actual network access flowed overseas. Investigators identified 11 fraudulent Gmail accounts used across the scheme, and employers are being urged to add them to detection lists.
One American named in the indictment, Trey Michael Nolte of Ohio, allegedly recruited, managed, and trained Bostelle and others. He was named but not charged. According to the indictment, Nolte kept around two dozen company laptops online, installed remote-access software, and moved more than $320,000 through accounts under false names. Bostelle allegedly provided his name and a fraudulent driver’s license to help a remote worker land a job. Carrillo allegedly hosted laptops under different names and collected around $190,000 from five employers.
According to the indictment, the scheme ran from 2019 to around July 2025. False employment records were filed with the Department of Homeland Security, the IRS, and the Social Security Administration under the names of more than 25 identity-theft victims.
FBI advisories have documented North Korean IT workers stealing sensitive data and extorting victim companies in past schemes. CrowdStrike, which assisted the FBI investigation and tracks this group as “Famous Chollima,” has noted that dismantling a single laptop farm has limited impact on the wider operation.
Bigger than this one case
The DOJ says the fraud touched more than 70 US companies across Ohio, 16 other states, and the District of Columbia, in sectors including healthcare, retail, communications, manufacturing, and cyber support. The operation generated at least $3 million, money prosecutors say supports North Korea’s sanctioned weapons programs.
The FBI issued a separate public service announcement the same day warning about the evolving threat. North Korean operatives are now paying Americans to appear in job interviews, take drug tests, and provide account access on their behalf, and targeting people under financial strain. The State Department is offering rewards of up to $5 million for information that helps disrupt the regime’s illicit financial networks.
My read on this: the arrests are genuine progress, but the business model survives every takedown. As long as remote hiring runs on trust and a video call, the next farm is already operating somewhere.
If you hire remote workers, check these things
The scheme worked because hiring processes trusted documents more than verification. A few checks that would have caught it:
- Verify identity beyond the paperwork. A candidate who will not turn on the camera, or whose story shifts between calls, is a red flag the FBI has warned about before. Note that with facilitators now paid to attend interviews, a camera-on appearance alone is no longer proof.
- Watch the laptop. A company machine that never moves, never appears on video calls from its supposed location, or runs remote-access tools it should not have deserves a second look.
- Follow the money. Wages routed through third parties, or paid to accounts that do not match the employee’s name, are worth investigating. Check new-hire email addresses against the FBI’s published list of 11 fraudulent Gmail accounts.
Companies that discover an infiltrator on the payroll should treat it as a breach. Our guide to what to do after a data breach walks through the exact steps.
Sources
- DOJ press release: Coordinated actions to combat North Korean remote IT worker schemes
- Reuters: DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas
- TechCrunch: Justice Department says North Koreans have infiltrated dozens of U.S. companies
Correction (October 14, 2026): An earlier version of this article misspelled Trey Michael Nolte’s first name, stated 12 individuals were charged instead of 14, and attributed the data-extortion claim to prosecutors in this case rather than to prior FBI advisories. These have been corrected.
