DOJ charges 14 and seizes 187 devices in North Korean laptop farm crackdown in Texas

The U.S. Department of Justice announced on October 13, 2026 that it had charged 14 people and seized roughly 187 laptops and other devices in Operation Lonestar Roundup, a crackdown on Texas 'laptop farms' that allowed North Korean IT workers to pose as U.S. employees at more than 70 companies. The announcement marked one of the most visible enforcement actions to date against a scheme that security researchers have tracked for years.

At the center of the case are two Americans, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested and charged with wire fraud, money laundering and identity theft. Prosecutors allege they worked with ten China-based operators who directed them and at least four other Americans, using stolen and fabricated identities to hold remote jobs at U.S. companies from 2019 through 2025 and collect about $3 million in pay.

The FBI conducted searches between September 21 and September 25, 2026 at more than 40 residences in Texas suspected of operating as laptop farms for North Korean workers, seizing the devices. An indictment unsealed in the Northern District of Ohio named ten defendants based in China: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long. Two unnamed defendants were also charged, bringing the total to 14.

A separate disclosure from CrowdStrike, reported by Cyber Security News on October 14, 2026, tied the U.S. disruption to FAMOUS CHOLLIMA, a North Korean threat group that has built a domestic support network inside the United States. CrowdStrike described the FBI operation in late September 2026 as the start of a wider effort against that network, while warning that the group remains active.

Key Facts

The numbers are stark. Reuters reported on October 13, 2026 that the Justice Department announced the arrests of two Americans and the seizure of roughly 187 devices in the Texas crackdown. The indictment says the fraud impacted more than 70 U.S. companies, compromised the identities of 25 Americans, sent false information to multiple U.S. government agencies, and generated at least $3 million in revenue for the overseas IT workers.

CyberScoop reported on October 13, 2026 that the indictment was unsealed in the Northern District of Ohio. It alleges that the defendants held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities and collected about $3 million in pay. Trey Michael Nolte, an Ohio resident, was named as a co-conspirator but not charged. He allegedly kept roughly two dozen company laptops online for overseas workers, installed remote-access software, and moved more than $320,000 through accounts opened under false names.

Bostelle allegedly provided his name and a fraudulent driver's license, while Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers. Prosecutors allege the men filed false employment records with the Department of Homeland Security, the Internal Revenue Service and the Social Security Administration in the names of more than 25 identity theft victims.

Cyber Security News reported on October 14, 2026 that CrowdStrike disclosed the joint operation and said dozens of affected organizations operated across aerospace, energy, finance, healthcare, cybersecurity, defense engineering, government technology and consumer technology. CrowdStrike researchers identified false identities, technical indicators and U.S. computers supporting the scheme between April 2025 and June 2026. Since May 2026, the group was observed spoofing device hashes, including making a video capture card appear to be a webcam, and reusing the same disguised device across separate victim organizations.

Among the tools CrowdStrike flagged for review were Astrill VPN, AnyDesk, OBS Studio and PiKVM. The firm also described how operatives filed false police reports claiming laptops were stolen, then requested replacements at farm addresses, or claimed sudden moves to redirect deliveries. Some obtained jobs through IT staffing firms.

Analysis

What this really means is that North Korea's IT worker scheme is not a distant cyber threat but a domestic criminal enterprise with American facilitators, American addresses and American bank accounts. The Texas laptop farms were physical infrastructure: homes holding employer-issued laptops that North Korean engineers controlled remotely from abroad. That model let operatives hide their locations, collect salaries for Pyongyang and keep persistent access to employer systems.

The case also shows how the scheme mutated to survive detection. CrowdStrike noted that operatives filed false police reports claiming laptops were stolen and then requested replacements at farm addresses, or claimed sudden moves to redirect deliveries. Since May 2026, the group spoofed device hashes, making a video capture card appear to be a webcam and reusing the same disguised device across separate victim organizations. Those tactics are designed to defeat the device and identity checks that many companies rely on.

The bigger picture here is that the enforcement action is a disruption, not a defeat. CrowdStrike warned that the FBI operation will likely have only a limited local effect and that FAMOUS CHOLLIMA remains active and is expected to adapt. The group has worked across aerospace, energy, finance, healthcare, cybersecurity, defense engineering, government technology and consumer technology, which means the victim pool is broad and the financial motive is only part of the risk. Stolen identities and covert access points inside U.S. borders give a hostile regime a foothold that is hard to measure and harder to remove.

The scale of the alleged fraud, more than 70 companies and at least $3 million in wages, also highlights how lucrative the model is. Even if 14 people are charged and 187 devices are seized, the underlying demand for remote IT labor and the difficulty of verifying a remote worker's true location and identity remain. U.S. Attorney Ryan Raybould of the Northern District of Texas called it 'a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.' That framing places the laptop farm problem at the intersection of immigration fraud, identity theft and national security.

Why It Matters

The operation matters because it targets the domestic support layer that makes North Korea's remote IT worker scheme possible. Without Americans willing to lend their names, host laptops and move money, overseas operatives would struggle to pass employment screening. The indictment alleges that Nolte recruited, managed and trained Bostelle and others, who let their names and personal information be used and hosted company laptops at their homes so North Koreans appeared to be legitimate U.S.-based employees.

It also matters for the 25 identity theft victims whose personal information was used in false employment records filed with the Department of Homeland Security, the Internal Revenue Service and the Social Security Administration. Those records can create years of tax and benefits problems for victims, even after the criminal case ends. And the more than 70 affected companies span critical sectors, including defense engineering and government technology, which raises the stakes beyond ordinary payroll fraud.

Finally, the case shows that the FBI is willing to treat laptop farms as physical search targets. The searches at more than 40 Texas residences between September 21 and September 25, 2026, and the seizure of roughly 187 devices, are a tangible sign that the bureau is mapping and dismantling the infrastructure piece by piece. CrowdStrike described the effort as the start of a wider campaign against the group's domestic support network.

Next Up

The immediate next steps will be in court. The two Americans arrested, Bostelle and Pena Carrillo, face wire fraud, money laundering and identity theft charges, while ten China-based defendants and two unnamed defendants remain at large or unidentified. Trey Michael Nolte was named as a co-conspirator but not charged, which leaves open the possibility of additional charges. The Northern District of Ohio indictment and the Northern District of Texas investigation will proceed in parallel.

On the security side, CrowdStrike expects FAMOUS CHOLLIMA to adapt. Companies that rely on remote IT workers should review the tools the firm flagged, including Astrill VPN, AnyDesk, OBS Studio and PiKVM, and should watch for the device-hash spoofing and laptop replacement tactics described in the disclosure. The broader lesson is that the laptop farm model persists because it works, and the FBI's disruption in Texas is likely to be followed by more searches, more seizures and more charges.