US charges two Americans and ten China-based people over North Korean IT worker laptop farms that placed workers at 70+ US companies; FBI's Operation Lonestar Roundup searches 40 Texas sites and seizes 187 laptops and KVM devices
US authorities announced a new crackdown on North Korean remote IT worker schemes on 13 and 14 October 2026. A four-count indictment charges Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested, with helping North Korean IT workers obtain remote jobs by housing and configuring laptops issued by US employers so the workers appeared to be in the US. Prosecutors say the scheme ran from 2019 to July 2025, generated more than US$3 million and placed workers at over 70 US companies in communications, cyber support, healthcare, manufacturing and retail; ten China-based people are also charged. Separately, in Operation Lonestar Roundup, the FBI searched 40 suspected laptop farm locations in Texas and seized 187 laptops and KVM devices. CrowdStrike, which tracks the activity as Famous Chollima and assisted the operation, says victims of the disrupted clusters span aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology, and expects the disruption to be short-lived. The FBI's new public service announcement (PSA261013) warns the workers increasingly pay witting and unwitting US residents to appear on camera, sit interviews, verify identities, ship packages or keep company devices online from home, and recommends layered identity checks across the employment lifecycle. No Australian victims are named. Primary: FBI IC3 PSA; SecurityWeek and iTnews coverage.
- Product
- n/a (law-enforcement action — North Korean remote IT worker scheme, Famous Chollima)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- Nothing to patch. Hiring teams: verify identity in person or by live video with document checks, confirm the shipping address for company laptops matches the verified employee, block unapproved remote-access and KVM tools, and alert on one device identity reused across accounts or logins from VPN and proxy ranges.
Primary: FBI IC3 — North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (PSA261013, 13 Oct 2026) · Vendor: CrowdStrike — U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance · SecurityWeek — US arrests two in crackdown on North Korean IT worker laptop farms (14 Oct 2026)