FBI Dismantles North Korean "Laptop Farms" Across Texas, Arrests Two in $3M Identity Scam

WASHINGTON — Federal agents have dismantled a major network of "laptop farms" operating out of more than 40 homes across Texas, where North Korean IT workers posed as remote American employees to generate millions in revenue for Pyongyang's weapons programs.

The Department of Justice announced Tuesday that the FBI seized roughly 187 laptops and other devices between September 21 and 25, in what it dubbed Operation Lonestar Roundup — one of the largest crackdowns yet on North Korea's lucrative IT-worker scam.

Two Americans were arrested: Michael James Bostelle of Pennsylvania and Juan Ceclilio Pena Carrillo of Texas, charged with wire fraud, money laundering, and identity theft. The indictment also charged ten China-based North Koreans accused of directing the operation.

According to the DOJ, North Korean operatives funneled their remote work through employer-issued laptops physically located in U.S. homes. American facilitators received the laptops, configured them, and hosted them at their residences so it appeared the North Koreans were legitimate U.S.-based employees working on-site. Earnings were routed to North Korean-controlled accounts, funding the regime's sanctioned nuclear and ballistic missile programs.

The FBI said the scheme compromised the identities of 25 Americans, hit more than 70 U.S. companies, sent false information to multiple government agencies, and generated at least $3 million for the overseas workers.

Cybersecurity firm CrowdStrike, which assisted the FBI, tracks the network as "Famous Chollima." It said the affected organizations spanned aerospace, energy, financial services, health care, cybersecurity, defense engineering, and government technology.

"Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability," said U.S. Attorney for the Northern District of Texas Ryan Raybould.

FBI Dallas Special Agent in Charge R. Joseph Rothrock warned employers: "Each laptop seized potentially represents one company that has hired a DPRK IT worker."

Separately, the DOJ unsealed indictments in Ohio against two U.S. nationals and ten China-based North Koreans in a related identity-theft scheme prosecutors say bilked 70 companies out of more than $3 million between 2019 and 2025.

Sources

• Reuters: "DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas"
• U.S. Department of Justice: "Operation Lonestar Roundup"
• Nextgov: "FBI disrupts North Korean 'laptop farm' used to infiltrate US companies"