Threat reportAPTTL-2026-3464
North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies
North Korean IT Worker Laptop Farms in Texas Disrupted by (TL-2026-3464), also tracked as Operation Lonestar Roundup, is a high-severity advanced persistent threat campaign, first published 2026-10-14. It is attributed to WageMole (North Korea) with high confidence, affects Various U.S. employers hiring remote IT staff (healthcare, maps to 13 MITRE ATT&CK techniques (T1036, T1078, T1090), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 1WageMole
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3464
- Threat ID
- TL-2026-3464
- Also known as
- Operation Lonestar Roundup, DPRK remote IT worker scheme, North Korean laptop farms
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- health, communications, cybersecurity, retail, manufacturing, government administration
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 22
- Updates
- 2026-10-14 · revalidated 1× · latest source
Malware and tooling in North Korean IT Worker Laptop Farms in Texas Disrupted by
Malware and tooling: KVM devices, Remote-access software, Video capture cards disguised as webcams
How North Korean IT Worker Laptop Farms in Texas Disrupted by works
On 2026-10-13 the DOJ announced charges against 14 people and the results of Operation Lonestar Roundup, in which 40+ Texas residences suspected of hosting 'laptop farms' were searched (Sept 21-25, 2026) and about 187 laptops and KVM devices were seized. The North Korean remote IT worker scheme (2019 through July 2025 per the indictment) defrauded 70+ U.S. companies and generated about $3 million in revenue.
The U.S. Department of Justice unsealed an indictment in the Northern District of Ohio on 2026-10-13 charging 14 individuals in a North Korean remote IT worker scheme. Two U.S. nationals, Michael James Bostelle (Pennsylvania) and Juan Cecilio Pena Carrillo (Texas), were arrested on wire fraud, money laundering and identity theft charges. Ten China-based individuals (Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long) were charged, and two further defendants remain sealed. Per DOJ the scheme ran from 2019 through July 2025 and affected more than 70 U.S. companies across Ohio, 16 other states and the District of Columbia, compromising the identities of 25+ Americans and generating at least $3 million. Sectors named include healthcare, communications, cyber support, retail and manufacturing.
The mechanics follow the known 'laptop farm' model. North Korean workers used stolen or fabricated U.S. identities to obtain remote IT jobs. U.S.-based facilitators received and hosted employer-issued laptops in their homes so that the workers, located abroad, appeared to be working from the U.S. DOJ lists VPNs, proxy infrastructure, remote-access software and KVM devices as enabling tools. In Operation Lonestar Roundup (Sept 21-25, 2026) investigators searched 40+ Texas residences and seized approximately 187 laptops and KVM devices. CyberScoop reports that co-conspirator Trey Michael Nolte (Ohio, not charged) allegedly kept about 24 company laptops online, installed remote-access software and moved $320,000+ through fraudulent accounts; Bostelle allegedly supplied identity documents; Carrillo allegedly hosted laptops under false names and received about $190,000 from five employers. CyberScoop also reports false employment records filed with DHS, IRS and SSA.
Reported evolution in tradecraft: paying U.S. citizens to appear in interviews, drug tests and account access; recruiting financially vulnerable Americans and identities eligible for security-clearance roles including active-duty military; subcontracting work to freelancers in Pakistan, India and Nigeria; spoofed device identifiers (video capture cards presented as webcams); reuse of devices across jobs; and in-person threats against companies and former managers after removal of ITW-linked accounts. Workers were located in China, Russia, Laos, Cambodia, Pakistan, India and Nigeria. Post-hire data theft and extortion has been reported in related FBI/TechCrunch coverage. The activity is attributed to Famous Chollima (CrowdStrike naming), linked by CyberScoop to the Munitions Industry Department's 313 General Bureau. The State Department offers rewards of up to $5 million. The FBI released a PSA on 2026-10-13 on updated recruitment tactics. No CVEs, IP addresses, domains or file hashes were published; the only machine-readable indicators are 11 Gmail accounts listed in the DOJ release. BeaconBeagle was not queried because no network IOC (IP/domain) was published.
MITRE ATT&CK techniques used in TL-2026-3464
Defense Evasion
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1199 Trusted Relationship
Command and Control
T1090 Proxy; T1219.002 Remote Access Tools: Remote Desktop Software; T1219.003 Remote Access Tools: Remote Access Hardware
Resource Development
T1583 Acquire Infrastructure; T1585.001 Establish Accounts: Social Media Accounts; T1585.002 Establish Accounts: Email Accounts
Reconnaissance
T1589 Gather Victim Identity Information
Impact
stealth
Affected products and versions in North Korean IT Worker Laptop Farms in Texas Disrupted by
- Various — U.S. employers hiring remote IT staff (healthcare, communications, cyber support, retail, manufacturing)
Vulnerable versions: Not applicable - process/identity-verification weakness, no software vulnerability
Remediation for North Korean IT Worker Laptop Farms in Texas Disrupted by
Immediate actions
- Search HR/ATS, payroll and IAM records for the 11 Gmail accounts listed by DOJ
- Inventory employer-issued laptops shipped to residential addresses and verify physical location and user
- Alert on unapproved remote-access software and KVM/capture-device USB enumeration on corporate endpoints
Workarounds
- Report suspected North Korean IT worker activity to the FBI (IC3.gov)
Longer-term hardening
- Require live, on-camera identity verification and in-person or notarized document checks at hire and before device shipment
- Monitor for address changes between offer and device delivery and for reuse of devices, bank accounts and phone numbers across employees
- Restrict remote access to managed, approved tooling and enforce device-bound conditional access with geolocation anomaly review
- Brief HR, recruiters and managers on in-person intimidation and extortion scenarios and define an escalation path to security/legal
Timeline of North Korean IT Worker Laptop Farms in Texas Disrupted by
- Start of the North Korean remote IT worker scheme charged in the indictment (DOJ gives 2019 as start year; exact date not stated)
- FBI/IC3 PSA I-051624-PSA published on North Korean IT worker fraud, U.S. facilitators and red-flag indicators
- CrowdStrike Counter Adversary Operations begins tracking the FAMOUS CHOLLIMA laptop-farm network (April 2025 to June 2026), identifying personas, technical indicators and linked U.S.-based computers.
- The Record notes that in 2025 about 30 laptop farms across 16 states were raided (exact date not stated; mid-2025 used as approximation)
- Charged conduct period ends in July 2025 per the DOJ release (exact day not stated)
- CrowdStrike observes the group spoofing device hashes since May 2026, including making a video capture card appear as a webcam and reusing the disguised device across victim organizations (exact day not stated).
- End of CrowdStrike's tracking window; it separately reported 320+ North Korean remote-IT-worker incidents in the year to June 30, a 220% increase.
- Operation Lonestar Roundup begins: searches of 40+ Texas residences suspected of hosting laptop farms
- Searches conclude with about 187 laptops and KVM devices seized
- Indictment unsealed in the Northern District of Ohio: 14 charged; Bostelle and Pena Carrillo arrested; FBI publishes updated PSA on recruitment tactics
- Public reporting (GBHackers) relays CrowdStrike's assessment that the takedown's impact is geographically limited rather than enduring, since operatives can relocate farms and adapt techniques.
Update history for TL-2026-3464
- 2026-10-14 — FAMOUS CHOLLIMA North Korean IT Worker Scheme and Laptop Farms (Operation Lonestar Roundup): What changed No severity, exploitability or status change (HIGH / ACTIVE already). Intelligence enriched with CrowdStrike tracking details: device-hash spoofing since May 2026 with a reused capture-card 'webcam', 320+ incidents in the year
Sources cited for North Korean IT Worker Laptop Farms in Texas Disrupted by
- Justice Department announces coordinated actions to combat North Korean remote IT worker scheme
- Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
- DOJ charges 14 over a sprawling North Korean remote work scheme
- Justice Department says North Koreans have infiltrated dozens of U.S. companies
- DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas
- FBI PSA I-051624-PSA: North Korean IT worker fraud scheme
Detection coverage for TL-2026-3464
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3464 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.