DOJ and FBI Charge 14, Seize ~187 Devices in North Korean Remote IT Worker Schemes Hitting 70+ U.S. Companies
ANALYSIS · October 16, 2026
Slug: doj-fbi-north-korean-remote-it-workers-laptop-farms
Package note: This analysis covers a Justice Department press release of October 13, 2026. The indictment’s contents are allegations. All defendants are presumed innocent.
Primary sources
- U.S. Department of Justice, “Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies” (October 13, 2026): https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker
DOJ announced an indictment in the Northern District of Ohio, two arrests, and “Operation Lonestar Roundup,” in which the FBI searched more than 40 suspected “laptop farms” in Texas between September 21 and 25. DOJ says about 187 laptops and KVM devices were seized. KVMs are keyboard-video-mouse switches used to control several computers.
Core Tension
According to the indictment, North Korean IT workers used stolen or fabricated identities to get remote jobs at U.S. companies. U.S.-based helpers hosted the company-issued laptops so the workers appeared to be in the United States. The Ohio case alleges about $3 million in revenue across more than 70 employers. That is small next to the “hundreds of millions” a year a 2022 advisory said such workers can earn collectively. The two people arrested are Americans: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. The ten named foreign defendants are described as China-based and are unlikely ever to face a U.S. court. The FBI’s count of 14 charged matches the Ohio indictment: 12 named defendants plus 2 under seal. The release does not say whether anyone has been charged in the Texas operation.
What the release says
| Element | Release text / effect |
|---|---|
| Ohio indictment | Four counts: wire fraud, money laundering, identity theft |
| Arrested | Michael James Bostelle (Pa.), Juan Cecilio Pena Carrillo (Tex.), both U.S. nationals |
| Other defendants | 10 China-based individuals named; 2 under seal |
| Scheme period | 2019 to around July 2025 |
| Impact | More than 70 U.S. employers in Ohio, 16 other states and D.C.; ~$3 million in revenue, “believed” sent to sanctioned DPRK entities |
| Texas operation | Searches at 40+ residences, Sept. 21–25; ~187 laptops/KVM devices seized |
| Employer guidance | New FBI public service announcement; 11 email addresses listed as indicators |
| Rewards | State Department offers up to $5 million |
Claims check
| Claim | Assessment | Receipt |
|---|---|---|
| More than 70 companies affected | DOJ allegation | Indictment summary |
| ~$3 million generated | DOJ allegation | Release |
| Money funds DPRK weapons programs | DOJ assessment | “believed to have been sent to sanctioned entities” |
| 14 charged | Consistent | Ohio indictment: 10 named foreign defendants + 2 arrested + 2 sealed |
| CrowdStrike calls the group “Famous Chollima” | Attributed | Release |
How coverage splits
Not reviewed for this analysis.
Context / what to watch
- Court dates: Detention hearings and arraignments for Bostelle and Pena.
- Texas: Whether Operation Lonestar Roundup leads to charges.
Publish-ready ANALYSIS · written by KVOp from the DOJ release · 2026-10-16 · for /analysis/doj-fbi-north-korean-remote-it-workers-laptop-farms