Federal agents searched more than 40 homes in Texas in late September. On Tuesday, October 13, the Justice Department unsealed an indictment that charges 14 people and announced the arrests of two U.S. nationals. Investigators say the roughly 187 laptops and other devices the FBI seized were the physical core of a scheme that made North Korean contractors look like they were working from American homes.
The operation is called Operation Lonestar Roundup, and it carries a direct warning for U.S. employers. Any company that hired remote engineers, developers or support staff in recent years could have a worker it cannot place. The Spokesman-Review, republishing Reuters reporting, identifies the two arrested men as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both face wire fraud, money laundering and identity theft charges.
How laptop farms made overseas workers look American
A laptop farm is a simple arrangement with a serious payoff. An American employer ships a company laptop to a U.S. address, where a local host keeps it powered on and connected. The host runs remote-access software so the machine works around the clock, and Bellator Cyber notes that monitoring logs then show a U.S. address for the worker.
The fake identities and anonymizing tools did the rest. According to SecurityWeek, facilitators configured laptops that U.S. employers had issued so North Korean workers could appear to be based in the United States. They used fake IDs and VPN and proxy infrastructure to mask the workers' real locations. Nextgov/FCW reports that the U.S.-based facilitators also sent earnings to accounts controlled by North Korea.
The FBI's Dallas office framed the stakes in direct terms. "Each laptop seized potentially represents one company that has hired a DPRK IT worker," said FBI Dallas Special Agent in Charge R. Joseph Rothrock, in a statement reported by Nextgov. Read literally, every seized machine is a possible employer exposure, which is why the device count may matter more than the arrest count.
CrowdStrike, which tracks the group as Famous Chollima, said its work with the FBI disrupted several U.S. laptop farms in late September, according to Nextgov. Nextgov also reports that prosecutors said about 100 devices were recovered in North Texas.
Who is charged, who is free and when it happened
The indictment names 14 defendants. The Hacker News reports that ten individuals are based in China and that the indictment says China-based operators directed Pena, Nolte and at least four other Americans. Trey Michael Nolte is named as a U.S.-based co-conspirator but has not been charged. The indictment alleges that he ran a shell company, Dark Falls LLC, which claimed to offer software development services.
The timeline runs back several years before the arrests.
| Date | Event |
|---|---|
| Around 2019 | The fraud begins, according to the Justice Department and reporting on the case |
| July 2025 | The fraud period ends |
| September 21 to 25, 2026 | FBI searches more than 40 residences in Texas |
| Late September 2026 | CrowdStrike says its work with the FBI disrupted several U.S. laptop farms |
| October 13, 2026 | Indictment unsealed and arrests announced |
The sources do not explain why the searches came more than a year after the fraud period ended. That gap is one of the first questions a reader should ask.
What the scheme cost companies and Americans
Workers obtained jobs at more than 70 U.S. companies in communications, cyber support, healthcare, manufacturing and retail, according to DOJ-based reporting. The Justice Department says the scheme generated over $3 million for North Korea, and the DOJ's own release says the department is taking "coordinated actions" against the regime's efforts to fund itself through remote IT work for U.S. companies.
The human cost includes identity theft. The Spokesman-Review report cites a prosecutor's figure that 25 Americans had their identities compromised. U.S. Attorney Ryan Raybould for the Northern District of Texas put the case in broader terms in the DOJ release. "This investigation is about far more than fraud," Raybould said.
FBI Cyber Division Assistant Director Brett Leatherman described the threat in similar terms. "North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies," he said, according to the DOJ release.
The insider risk is the part that should worry security teams most. BleepingComputer reports that some of these workers also tried to compromise employer networks to steal data, deploy malware or obtain cryptocurrency. A worker who passes a background check and holds a company laptop can reach systems that a random intruder never could.
The warnings are not new. Bellator Cyber reports that federal agencies, including the FBI, DOJ and Treasury's OFAC, have warned since at least 2022 that North Korean operatives use fabricated or stolen American identities to win tech jobs. The lesson for employers is that identity checks built on documents alone have not kept pace with the scheme.
Where the reporting conflicts and what remains open
The Ohio question is unresolved. The DOJ release's headline refers to actions "in Ohio and Texas," while most reporting describes the searches as Texas-only. Reporting says victim businesses were located across much of the country, including Ohio, so the state's role needs clarification before anyone draws conclusions.
The victims remain anonymous. The sources reviewed do not name any of the affected companies, and the full list of more than 70 employers is not public. Employers who suspect exposure have no public list to check against.
Most defendants are still free. Of the 14 charged, only two are in custody. The rest, including the China-based defendants, remain at large. Pleas, trial dates and additional charges are not reported in the sources reviewed.
The case may not be finished. CyberScoop and Bellator Cyber describe the investigation as ongoing, which raises the possibility of more arrests or indictments.
How employers can spot North Korean remote workers
No single signal proves that a remote hire is an overseas operative. The steps below are general guidance, not findings from the case documents, but they target the weak points the case exposed.
- Compare device login locations, IP addresses and time zones with the address and schedule the candidate claimed. Round-the-clock logins from one U.S. address deserve a closer look.
- Flag VPN or proxy use on company devices, especially when it changes from one session to the next.
- Require live video identity verification during hiring and at intervals afterward. Match the face on camera to the identity documents on file.
- Confirm who receives and signs for company equipment, and question shipments to shared residences or third-party addresses.
- Limit contractor access to what the job requires, and watch for large data transfers, unfamiliar remote-access software or cryptocurrency activity on work machines.
- If a hire looks wrong, bring in HR, legal and security teams, and report the concern to the FBI rather than confronting the worker.
What comes next
The next signals will come from court filings rather than press releases. Watch for pleas, trial dates, additional arrests and any public naming of victim companies. Because the investigation is described as ongoing, more indictments are possible.
For employers, the more immediate question is internal. How many remote engineers, contractors and company laptops in your environment could pass a live video check and a location audit today? That answer will tell you more about your exposure than any single arrest.
