All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Op. Lonestar Roundup : North Korea Laptop Farm
Federal prosecutors in Ohio have charged two American men, one from Philadelphia and one from Texas, with helping North Korean IT workers land remote positions at more than 70 U.S. companies. The workers allegedly used stolen or fake identities to collect paychecks that largely returned to the regime in Pyongyang.
Authorities charged 14 people in total through a Northern District of Ohio indictment that also covers ten China-based defendants who remain at large and two individuals whose names are sealed. Investigators seized about 187 laptops and keyboard-video-mouse devices, which let operators control multiple computers remotely from one location, during searches of more than 40 suspected laptop farms across Texas. The State Department is offering rewards of up to $5 million for information that leads to the disruption of the networks.
Northern District of Texas United States Attorney Ryan Raybould said in a statement:
“This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”How It Allegedly Worked
The scheme, which ran from roughly 2019 until about July 2025 according to the Ohio indictment, involved facilitators who hosted company-issued laptops in the United States so that North Korean workers based overseas could appear to be operating from domestic addresses. In the Ohio case, Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas, were arrested. Bostelle allegedly provided his name and a fraudulent driver’s license to help a remote worker obtain employment, while Pena Carrillo is accused of hosting laptops at his home under various names and receiving about $190,000 from five employers.
An uncharged Ohio co-conspirator identified in the indictment as Trey Michael Nolte allegedly kept roughly two dozen company laptops online, installed remote-access software, and moved more than $320,000 through accounts opened in false names. Reuters reported that Nolte also recruited and trained Bostelle. The identities of more than 25 Americans were compromised in the scheme, which generated about $3 million in pay that authorities believe reached North Korean entities. More broadly, FOX 4 Dallas-Fort Worth reported that the North Korean workers allegedly send around 85% to 90% of their pay to the regime.
Texas Raids and Ongoing InvestigationIn Texas, FBI agents searched more than 40 residences between September 21st and 25th as part of Operation Lonestar Roundup. More than 100 of the devices seized in the broader operation came from North Texas. No arrests have been announced from those searches.
“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said.
According to a report from CBS Texas, Raybould has indicated that indictments of the hosts are forthcoming. “It’s very hard to claim you didn’t know what you were doing when you’re hosting 30, 40, 50 laptops in your house,” he said at a press conference. Rothrock described similar laptop farm operations in Louisiana, Nevada, Kentucky, and Ohio.
An FBI public service announcement issued the same day as the charges described how North Korean workers pay Americans to appear on camera during interviews, verify identities, ship packages, take drug tests, or keep devices online. The alert noted that facilitators are often recruited under financial stress and have faced threats of violence.
Cybersecurity firm CrowdStrike, which assisted in the disruption and tracks the activity as FAMOUS CHOLLIMA, cautioned that the operations “will likely slow” activity “only in the immediate areas” and are “unlikely to create long-lasting effects.”
Similar cases have produced convictions in recent years. An Arizona woman, Christina Chapman, was sentenced in July 2025 to 102 months in prison after she pleaded guilty to running a laptop farm that generated more than $17 million for North Korea while affecting more than 300 companies. Earlier this year, two New Jersey men were sentenced in Massachusetts to 108 and 92 months for facilitating a scheme that generated more than $5 million for North Korea, and two others from Tennessee and New York received 18 months each for related facilitation schemes.
One low-tech method companies have used to guard against nefarious job applicants associated with the North Korean regime is asking “How fat is Kim Jong Un?” during interviews, a question that CrowdStrike’s Adam Meyers said causes North Korean candidates to terminate the call immediately.
Crypto firms have been frequent targets of North Korean operations, both through earlier remote worker schemes and through direct thefts. Bitget said North Korea was “very likely” behind a $387.5 million hack last month, while blockchain analysis firms have also linked the regime to a six-month intelligence operation that preceded a $285 million theft and to last year’s $1.4 billion Bybit heist. North Korea previously declined responsibility associated with these sorts of accusations in a rare public comment on the matter.
I think I know what question to throw when someone asked a provider to colo a laptop
Comments
What question?
First!
Ask them what they think about K-Pop
How much reward were getting those who are involved in this activity?
Don't know. But if you snitch, $5M. That's enough for 256TB DDR5
did they also give 7$/Y VPS ?
Nope, just free company laptop.
I think i saw a (nuked) thread around 2 months ago someone asking for similar, they give you laptop you allow remote access to your home network. Maybe for this, or maybe for residential proxy, or both.
Yeah, there's often threads like this. Residential proxy is one thing, but a laptop colo and can't deliver it yourself? Very sketchy
i want one !
Anyone want to host a ESP32?
/s
But realistically, I guess you can achieve 1~5Mbps throughput if you use a custom tuned proxy or a shadowsocks-like tunnel in tls.
So wait, are they doing anything nefarious when they get the job or are they just doing their job and illegally sending most of their paycheck to North Korea?
source: gizmodo plus gazette blabla based on LEA blabla.
One simple question might open one's eyes: WHY?
Now, if those North-Koreans played it like "oh, we fled the cruel diktatura and wanted to create a life in freedom" it would be credible as in matching the established pattern, but hell NO they alledgedly sent most of their income to North-Korea!
So, that story IMO either is BS or the real reason was about siphoning something off those us-american companies (like tech, confidential data, etc.).
102 months = 8.5 years in a slammer. Damn!
Those are not rando NK people looking for a job, they are the highly trained operatives of the regime, either imprisoned in some facility with all communications monitored or real devotees to the Kims. They can achieve both stealing secrets and earning a wage for the regime in highly paid jobs.
While security for remote workers is kind of tight, they can easily "help a colleague" by remotely logging in and solving some problem, people with much higher access.
This is happening every day in all kinds of "secure" environments. The only peripheral nobody can really secure is the one between the chair and the keyboard.
Maybe, maybe not.
The guy who "recruited and trained" one of the defendants, and committed the most financial crime of anyone mentioned in the story, isn't being charged because American justice is the best in the world...
Both. Citizens only get access to the outside world to do NK bad stuff.
He snitched.