IT Scam
US arrests 2 Americans in North Korean IT scam targeting 70 firms
The US Department of Justice (DOJ) has announced the arrest of two American nationals accused of helping North Korean IT workers steal identities and secure fraudulent employment with US companies to generate revenue for the North Korean government.
The arrested individuals have been identified as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas.
Announcing the arrests, the Department of Justice said the two men were taken into custody pursuant to a four-count indictment charging wire fraud, money laundering and identity theft.
According to the indictment, Bostelle, Pena and their co-conspirators allegedly operated a multi-year fraud scheme that generated more than $3 million in revenue by securing remote IT jobs with US companies.
The indictment also names 10 China-based defendants — Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long — who are accused of participating in the scheme. The identities of two additional defendants remain under seal.
According to the indictment, the alleged scheme operated from 2019 until around July 2025. During this period, North Korean IT workers allegedly applied for and obtained remote jobs using stolen or fabricated identity documents, virtual private networks (VPNs) and proxy infrastructure to make it appear that they were US-based workers.
The workers allegedly relied on US-based facilitators who received and hosted multiple laptop computers issued by victim companies at their residences. These setups, known as “laptop farms”, were used to house and configure the devices, install remote-access software and facilitate the transfer of earnings to accounts controlled by North Korea.
The scheme allegedly affected more than 70 US employers and generated approximately $3 million in revenue for the North Korean IT workers.
“The revenue is believed to have been sent to sanctioned entities controlled by the DPRK,” the department said.
The affected employers operated across several sectors, including healthcare, communications, cybersecurity support, retail and manufacturing. The companies were located in Ohio, 16 other US states and the District of Columbia.
The FBI's Cleveland Field Office is investigating the case.
Between September 21 and September 25, the FBI conducted searches and other law enforcement operations at more than 40 residences in Texas that were known or suspected to have been used as laptop farms for North Korean IT workers.
As part of the wider operation, known as Operation Lonestar Roundup, the FBI seized approximately 187 laptops and keyboard, video and mouse (KVM) devices allegedly used by North Korean IT workers and their US-based facilitators to commit fraud, obtain remote employment and generate revenue for the North Korean regime's sanctioned weapons programmes.
US cybersecurity firm CrowdStrike has identified the North Korean IT workers and their associates involved in the scheme as “Famous Chollima”.
Support Our Journalism
We cannot do without you.. your contribution supports unbiased journalism
IBNS is not driven by any ism- not wokeism, not racism, not skewed secularism, not hyper right-wing or left liberal ideals, nor by any hardline religious beliefs or hyper nationalism. We want to serve you good old objective news, as they are. We do not judge or preach. We let people decide for themselves. We only try to present factual and well-sourced news.
Support objective journalism for a small contribution.
