Two US nationals were arrested in a new law enforcement operation targeting fraudulent North Korean IT worker schemes.
The suspects, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, allegedly helped North Korean IT workers (ITWs) illegally obtain remote work at US companies.
According to a four-count indictment, the multi-year fraud scheme by Bostelle, Pena, and their co-conspirators generated over $3 million in fraudulent revenue.
As part of the scheme, which allegedly ran between 2019 and July 2025, the two housed and configured laptops issued by victim US companies so ITWs would appear to work from the US.
Using fake IDs and VPN and proxy infrastructure masking their real locations, the ITWs, aided by US facilitators, obtained employment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.
The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long for participating in the scheme.
In a separate effort named Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of operating as laptop farms for ITWs and seized 187 laptops and KVM devices used to commit fraud.
Famous Chollima
According to CrowdStrike, which tracks the fake IT worker scheme as Famous Chollima, operatives abroad employ various deception techniques to convince employers to ship company-issued laptops to farm locations.
Some of these include filing fraudulent police reports about stolen laptops to obtain replacements, claiming sudden relocation to divert shipments, rotating through multiple residential addresses, and using IT staffing firms during the hiring process, which allowed end-client devices to be quietly redirected to laptop farms.
At the farm, US facilitators install hardware and software that enable ITWs to remotely access them.
In response to recent defenses organizations have been implementing, Famous Chollima started hiding the remote access tools, spoofing device hashes, and using the same device identifiers across multiple organizations and personas.
“Laptop farms are vital to Famous Chollima’s revenue-generating operations because they solve three problems the adversary cannot easily overcome from abroad: physical, financial, and legal,” CrowdStrike notes.
The farms and facilitators provide a US footprint that includes a physical address, a legal identity, and a mechanism to satisfy regulation, but their disruption is expected to have a limited impact on Famous Chollima.
CrowdStrike also points out that Famous Chollima’s activity is sector-agnostic, targeting any organization that offers remote employment as a source of revenue.
“The dozens of victim organizations identified across the clusters disrupted in this operation span critical sectors including aerospace, energy, financial services, healthcare, cybersecurity, defense engineering, government technology, and consumer technology,” CrowdStrike notes.
An ‘identity in depth’ approach to detect ITWs
In a fresh alert, the FBI warns the general public that ITWs are increasingly using facilitators to evade detection, relying on the help of witting and unwitting US nationals to obtain employment in the country.
“ITWs are paying Americans for an expanding range of services to hide their own involvement in the scheme, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences,” the FBI notes.
According to the Bureau, to identify ITWs reliably, organizations should look for multiple compounding behaviors and adopt an ‘identity in depth’ approach that involves layered access controls and detections throughout the employment lifecycle.
ITWs use remote desktop and remote monitoring and management (RMM) software, external hardware to control laptops, frequently download applications unrelated to their jobs, almost always exfiltrate data, tend to rotate through bank accounts and physical addresses, and forge verification documents for stolen identities to obtain employment.
“‘Identity in Depth’ — layered detections, access controls, and continuous identity verification throughout employment — avoids unreliable filters while enabling moderate, weak, or unavoidable signals to justify enhanced scrutiny when aggregated together. Evaluating identity-related fraud based on probabilistic behavioral data rather than easily bypassed rules provides defenders the resilience and flexibility necessary to counter North Korean ITWs and their ongoing tactical advancements,” the FBI notes.
Related: Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Related: North Korea Suspected in $351 Million Bitget Crypto Heist
Related: North Korean Hackers Deploy New Linux Espionage Toolkit
Related: Rust Supply Chain Attack Linked to North Korean Hackers
