U.S. charges North Korean-linked individuals

The U.S. Department of Justice (DOJ) announced charges against 14 individuals, including two U.S. citizens, for electronic fraud, money laundering, and identity theft linked to North Korean cyber operations. These individuals are accused of helping North Korean computer specialists secure fraudulent employment in American companies.

Laptop farms targeted in Texas

As part of the "Lonestar Roundup" operation, the FBI searched over 40 locations in Texas suspected of housing "laptop farms." These were places where North Korean workers used stolen identities to gain remote jobs and conduct cyber activities. Approximately 187 devices were seized during the operation.

North Korea's funding strategy

The scheme, active between 2019 and July 2025, is estimated to have generated about $3 million, which was allegedly sent to North Korean entities under sanctions. Investigators suggest this is part of a broader effort by North Korea to fund its weapons programs through global IT recruitment.

Cybersecurity experts warn of infiltration

A March 2026 report by IBM X-Force and Flare Research highlighted the scale of North Korean infiltration into corporate IT systems. The report claims that North Korean state actors may be operating behind seemingly normal job applications and internal communications to access sensitive data and company systems.

U.S. officials condemn the threat

John A. Eisenberg, Deputy Attorney General for National Security, warned that North Korea uses its network of computer workers to fund weapons development that could threaten the U.S. or its allies. He emphasized that the DOJ will continue to track and prosecute those aiding North Korea.

FBI and DOJ coordinate actions

The FBI and DOJ announced a series of coordinated actions against North Korean cyber threats, including charges against 14 individuals, two arrests, and the seizure of nearly 190 devices. These actions were conducted in collaboration with law enforcement in Ohio and Texas.

Indictments include U.S. citizens

On October 13, 2026, two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested as part of an indictment that charged them with electronic fraud and identity theft. The indictment details a scheme involving stolen identities and fraudulent employment in the U.S. tech sector.

Laptop farms used for fraud

The indictment describes how North Korean workers used stolen or forged documents and virtual private networks to appear as U.S. citizens. They relied on intermediaries in the U.S. to host and manage laptops provided by American companies, using them to access internal systems and transfer funds to North Korean accounts.

Operation targets Texas locations

Between September 21 and 25, 2026, the FBI conducted searches in over 40 residences in Texas suspected of being "laptop farms." The operation led to the seizure of 187 laptops and other devices used by North Korean operatives to commit fraud and support the DPRK's weapons programs.

FBI warns of evolving threats

The FBI has issued public guidance to help American companies detect and prevent hiring North Korean cyber workers. These workers are increasingly using U.S. intermediaries to bypass detection systems and outsource tasks to foreign agents, according to the FBI.

CrowdStrike identifies North Korean group

Cybersecurity firm CrowdStrike identified the North Korean group involved in these operations as "Famous Chollima." Investigators linked the group to several fraudulent email accounts used to conduct cyber activities and secure remote employment in the U.S.

Public interest message issued

The FBI published a public interest message outlining the threat posed by North Korean cyber workers and offering recommendations for identifying and countering their activities. The message encourages employers to monitor for suspicious email accounts linked to the group.

New initiative to counter DPRK threats

The DOJ and FBI have launched the "DPRK RevGen: Domestic Enabler Initiative" to target the mechanisms North Korea uses to generate illicit revenue. This initiative focuses on disrupting the financial and operational networks that support North Korean cyber activities.