Counterintelligence — 2026-10-14

DOJ Charges 14 and FBI Seizes 187 Computers in Operation Lone Star Roundup Against North Korean IT Worker Scheme

BLUFArresting two U.S. facilitators and seizing 187 laptops disrupts one node, but Pyongyang's low-cost ability to recruit new domestic proxies ensures the IT worker model will persist and adapt.

The Justice Department announced on Tuesday that a Northern District of Ohio indictment, returned October 1, charges 12 defendants, including 10 China-based individuals and U.S. citizens Michael James Bostelle and Juan Cecilio Pena Carrillo, whom authorities arrested; two more defendants remain sealed 12. The indictment alleges the scheme ran from 2019 to about July 2025, affected more than 70 U.S. companies, and generated roughly $3 million 12. Under Operation Lonestar Roundup, the FBI searched more than 40 suspected Texas laptop-farm residences between September 21 and 25 and seized approximately 187 laptops and KVM devices 1. CyberScoop and Reuters, via the Spokesman-Review, identify Ohio resident Trey (Reuters: Tey) Michael Nolte as a named but uncharged co-conspirator, with CyberScoop reporting he moved more than $320,000 through accounts opened under false names 34.

Analysis
The Ohio indictment and Texas seizures disrupt one cluster of North Korean IT worker facilitation but leave intact the model that sustains it. Pyongyang's workers now pay U.S. citizens to sit interviews, pass drug tests and keep laptops running, so each arrest or seizure only forces recruitment of replacements. Ten of twelve named defendants remain at large in China, and two more stay sealed. Employers in 17 jurisdictions should expect further victim notifications as investigators trace the 70-plus companies, and should screen for the eleven listed email accounts and spoofed capture-card webcams. Confidence is high: two primary Justice Department documents agree on core facts, and CyberScoop and Reuters independently corroborate them. The operation may also signal private-sector visibility, since CrowdStrike judged the takedown would have limited lasting effect on Famous Chollima.

4 sources

Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes - U.S. Department of Justice, Office of Public Affairs
14 Indicted in North Korean Remote IT Worker Conspiracy Affecting More Than 70 U.S. Companies - U.S. Attorney's Office, Northern District of Ohio
DOJ charges 14 over a sprawling North Korean remote work scheme - CyberScoop
DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas - The Spokesman-Review (Reuters)