US investigators arrested two American facilitators and seized 187 laptops in a crackdown on North Korean IT workers who take remote jobs under false identities. The FBI searched 40 locations in Texas in an effort it calls Operation Lonestar Roundup.
What happened
SecurityWeek reports that Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested. A four-count indictment says the scheme, alleged to have run from 2019 to July 2025, generated more than 3 million dollars. The pair allegedly housed company-issued laptops so workers abroad would appear to be in the United States. Using fake IDs plus VPN and proxy infrastructure, the workers obtained jobs at more than 70 US companies in communications, cyber support, healthcare, manufacturing, and retail.
The indictment also charges ten China-based defendants. CrowdStrike, which tracks the activity as Famous Chollima, says farms solve the physical, financial, and legal problems of working from abroad. Newer tactics include hiding remote-access tools, spoofing device hashes, and reusing the same device identifiers across personas. An FBI alert says workers now pay Americans to appear on camera, sit interviews, pass identity checks, and keep laptops online at home.
Who is affected
Any employer that hires remote contractors or staff through a staffing firm, including firms outside the United States. The revenue motive is sector-agnostic. A hired worker who is not who they claim can also exfiltrate source code and customer data.
- Companies that ship laptops to a residential address the new hire does not actually use.
- Teams that allow unmanaged remote-desktop or RMM tools on corporate endpoints.
- Hiring managers who accept a camera-off interview or a last-minute address change.
What to do now
Match the person on the offer call to the person who receives the laptop, and block unapproved RMM and KVM-over-IP tools on corporate devices. Treat a sudden relocation, a stolen-laptop replacement request, or a staffing firm that redirects hardware as a fraud signal. Do not rely on a single ID check. The FBI's advice is layered identity verification across the whole employment lifecycle, not one document at onboarding.
Source: SecurityWeek. US arrests two in crackdown on North Korean IT worker laptop farms.
Also on the blog
- Ivanti Connect Secure CVE-2026-104935 exploited, patch by 16 Oct
- CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
- curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0
- Microsoft seizes YAM Store phishing kits behind 1 billion messages
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.