Two US nationals were arrested in a new law enforcement operation targeting fraudulent North Korean IT worker schemes.
The suspects, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, allegedly helped North Korean IT workers (ITWs) illegally obtain remote work at US companies.
According to a four-count indictment, the multi-year fraud scheme by Bostelle, Pena, and their co-conspirators generated over $3 million in fraudulent revenue.
As part of the scheme, which allegedly ran between 2019 and July 2025, the two housed and configured laptops issued by victim US companies so ITWs would appear to work from the US.
Using fake IDs and VPN and proxy infrastructure masking their real locations, the ITWs, aided by US facilitators, obtained employment at over 70 US companies in the communications, cyber support, healthcare, manufacturing, and retail sectors.
The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long for participating in the scheme.
In a separate effort named Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of operating as laptop farms for ITWs and seized 187 laptops and KVM devices used to commit fraud.
Famous Chollima
According to CrowdStrike, which tracks the fake IT worker scheme as Famous Chollima, operatives abroad employ various deception techniques to convince employers to ship company-issued laptops to farm locations.
Some of these include filing fraudulent police reports about stolen laptops to obtain replacements, claiming sudden relocation to divert shipments, rotating through multiple residential addresses, and using IT staffing firms during the hiring process, which allowed end-client devices to be quietly redirected to laptop farms.