# North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies

> On 2026-10-13 the DOJ announced charges against 14 people and the results of Operation Lonestar Roundup, in which 40+ Texas residences suspected of hosting 'laptop farms' were searched (Sept 21-25, 2026) and about 187 laptops and KVM devices were seized. The North Korean remote IT worker scheme (2019 through July 2025 per the indictment) defrauded 70+ U.S. companies and generated about $3 million in revenue.

- **Published:** 2026-10-14T04:41:29Z
- **Last reviewed:** 2026-10-14T05:42:50.426Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3464
- **ID:** TL-2026-3464
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The U.S. Department of Justice unsealed an indictment in the Northern District of Ohio on 2026-10-13 charging 14 individuals in a North Korean remote IT worker scheme. Two U.S. nationals, Michael James Bostelle (Pennsylvania) and Juan Cecilio Pena Carrillo (Texas), were arrested on wire fraud, money laundering and identity theft charges. Ten China-based individuals (Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long) were charged, and two further defendants remain sealed. Per DOJ the scheme ran from 2019 through July 2025 and affected more than 70 U.S. companies across Ohio, 16 other states and the District of Columbia, compromising the identities of 25+ Americans and generating at least $3 million. Sectors named include healthcare, communications, cyber support, retail and manufacturing.

The mechanics follow the known 'laptop farm' model. North Korean workers used stolen or fabricated U.S. identities to obtain remote IT jobs. U.S.-based facilitators received and hosted employer-issued laptops in their homes so that the workers, located abroad, appeared to be working from the U.S. DOJ lists VPNs, proxy infrastructure, remote-access software and KVM devices as enabling tools. In Operation Lonestar Roundup (Sept 21-25, 2026) investigators searched 40+ Texas residences and seized approximately 187 laptops and KVM devices. CyberScoop reports that co-conspirator Trey Michael Nolte (Ohio, not charged) allegedly kept about 24 company laptops online, installed remote-access software and moved $320,000+ through fraudulent accounts; Bostelle allegedly supplied identity documents; Carrillo allegedly hosted laptops under false names and received about $190,000 from five employers. CyberScoop also reports false employment records filed with DHS, IRS and SSA.

Reported evolution in tradecraft: paying U.S. citizens to appear in interviews, drug tests and account access; recruiting financially vulnerable Americans and identities eligible for security-clearance roles including active-duty military; subcontracting work to freelancers in Pakistan, India and Nigeria; spoofed device identifiers (video capture cards presented as webcams); reuse of devices across jobs; and in-person threats against companies and former managers after removal of ITW-linked accounts. Workers were located in China, Russia, Laos, Cambodia, Pakistan, India and Nigeria. Post-hire data theft and extortion has been reported in related FBI/TechCrunch coverage. The activity is attributed to Famous Chollima (CrowdStrike naming), linked by CyberScoop to the Munitions Industry Department's 313 General Bureau. The State Department offers rewards of up to $5 million. The FBI released a PSA on 2026-10-13 on updated recruitment tactics. No CVEs, IP addresses, domains or file hashes were published; the only machine-readable indicators are 11 Gmail accounts listed in the DOJ release. BeaconBeagle was not queried because no network IOC (IP/domain) was published.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585.001 Establish Accounts: Social Media Accounts
- T1585.002 Establish Accounts: Email Accounts
- T1078 Valid Accounts
- T1133 External Remote Services
- T1036 Masquerading
- T1219.002 Remote Access Tools: Remote Desktop Software
- T1219.003 Remote Access Tools: Remote Access Hardware
- T1090 Proxy
- T1684.001 Impersonation
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1199 Trusted Relationship

## Sources

- [Justice Department announces coordinated actions to combat North Korean remote IT worker scheme](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker)
- [Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue](https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas)
- [DOJ charges 14 over a sprawling North Korean remote work scheme](https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/)
- [Justice Department says North Koreans have infiltrated dozens of U.S. companies](https://techcrunch.com/2026/10/13/justice-department-says-north-koreans-have-infiltrated-dozens-of-u-s-companies)
- [DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas](https://theprint.in/world/doj-arrests-two-seizes-187-devices-in-north-korean-laptop-farm-crackdown-in-texas/3070976/)
- [FBI PSA I-051624-PSA: North Korean IT worker fraud scheme](https://ic3.gov/PSA/2024/PSA240516)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3464