Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by DPRK IT workers.
“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg. “These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft. NSD, along with our law enforcement partners, will use every available tool to track down anyone assisting the DPRK and to protect our national security.”
“Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”
“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”
“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Today, the FBI and DOJ announced a series of coordinated actions against this threat, securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected ‘laptop farms’ across Texas. Close coordination between the private sector and federal law enforcement was central to this operation. To further combat the threat, the FBI has issued a Public Service Announcement with detailed mitigation guidance for U.S. companies.”
Sun Sheng Ming, et al. Indictment and Arrests – Northern District of Ohio
Today, the U.S. Attorney’s Office for the Northern District of Ohio announced the arrests of U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas pursuant to a four-count wire fraud, money laundering, and identity theft indictment. The indictment describes a multi-year fraud scheme by Bostelle, Pena, and their co-conspirators to obtain remote IT work with U.S. companies that generated more than $3 million in revenue. The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long for their roles in the scheme. The identities of two additional defendants remain under seal.
According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers – issued by victim U.S. companies – at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.
In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.
The FBI Cleveland Field Office is investigating the case. Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the National Security Division’s National Security Cyber Section are prosecuting the case.
Operation Lonestar Roundup Disrupts Multiple Known or Suspected Laptop Farms in Texas
Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime’s sanctioned weapons programs. U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima.”
Investigators discovered that the DPRK operatives allegedly used a network of fraudulent email accounts to facilitate their criminal activity. The following accounts were among those identified as being used in these schemes: