Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies

Today the Department of Justice announced coordinated actions against the Democratic People's Republic of North Korea (DPRK) government's schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrests, searches of multiple known or suspected "laptop farms" in Texas pursuant to "Operation Lonestar Roundup," and the seizure of approximately 187 computer devices used by DPRK IT workers.

"North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies," said Assistant Attorney General for National Security John A. Eisenberg. "These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft. NSD, along with our law enforcement partners, will use every available tool to track down anyone assisting the DPRK and to protect our national security."

"Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation's economic strength to further and fuel their own nefarious agendas," said U.S. Attorney David M. Toepfer for the Northern District of Ohio. "We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices."

"This investigation is about far more than fraud," said U.S. Attorney Ryan Raybould for the Northern District of Texas. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security."

"North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs," said Assistant Director Brett Leatherman of the FBI's Cyber Division. "Today, the FBI and DOJ announced a series of coordinated actions against this threat, securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected 'laptop farms' across Texas. Close coordination between the private sector and federal law enforcement was central to this operation. To further combat the threat, the FBI has issued a Public Service Announcement with detailed mitigation guidance for U.S. companies."

Sun Sheng Ming, et al. Indictment and Arrests - Northern District of Ohio

Today, the U.S. Attorney's Office for the Northern District of Ohio announced the arrests of U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas pursuant to a four-count wire fraud, money laundering, and identity theft indictment. The indictment describes a multi-year fraud scheme by Bostelle, Pena, and their co-conspirators to obtain remote IT work with U.S. companies that generated more than $3 million in revenue. The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long for their roles in the scheme. The identities of two additional defendants remain under seal.

According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers - issued by victim U.S. companies - at their residences in the United States ("laptop farms"), housed and configured those devices, installed remote-access software and transferred earnings to DPRK-controlled accounts.

In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.

The FBI Cleveland Field Office is investigating the case. Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the National Security Division's National Security Cyber Section are prosecuting the case.

Operation Lonestar Roundup Disrupts Multiple Known or Suspected Laptop Farms in Texas

Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime's sanctioned weapons programs. U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as "Famous Chollima."

Investigators discovered that the DPRK operatives allegedly used a network of fraudulent email accounts to facilitate their criminal activity. The following accounts were among those identified as being used in these schemes:

• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected],
• [email protected], and
• [email protected].

Employers are encouraged to add these accounts to the list of indicators they use to identify and disrupt DPRK IT worker employment.

Today, the FBI published a public service announcement describing the evolving DPRK IT worker threat, including tips on how to detect the threat. Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. Additionally, CrowdStrike today published a blog postLinks to other government and non-government sites will typically appear with the "external link" icon to indicate that you are leaving the Department of Justice website when you click the link. describing its efforts at monitoring customer networks for DPRK IT worker activity and its successful collaboration with the FBI to disrupt this threat.

The U.S. Attorney's Office for the Northern District of Texas, the FBI's Dallas Field Office, and the FBI's Cyber Division coordinated Operation Lonestar Roundup. Valuable assistance was provided by the U.S. Attorney's Office for the Northern District of Ohio.

Today's announcements represent the Department's latest actions to combat North Korean IT worker schemes as part of a joint NSD and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK's illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in June 2025, November 2025, April 2026, and May 2026.

As described in Public Service Announcements published in May 2024, January 2025, July 2025, and today, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere. North Korean IT workers leverage these third parties, which include U.S.-based individuals, to gain fraudulent employment and access to U.S. company networks to generate this revenue.

Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a May 2022Links to other government and non-government sites will typically appear with the "external link" icon to indicate that you are leaving the Department of Justice website when you click the link. advisory released by the FBI, Department of the Treasury, and Department of State; a July 2023 advisory from the Office of the Director of National Intelligence; and guidance issued in October 2023 by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK's weapons programs.

The U.S. Department of State has offered potential rewards for up to $5 millionLinks to other government and non-government sites will typically appear with the "external link" icon to indicate that you are leaving the Department of Justice website when you click the link. in support of international efforts to disrupt the DPRK's illicit financial activities, including for cybercrimes, money laundering, and sanctions evasion.

The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.