Remote hiring fraud turns U.S. laptops into foreign access points

A company-issued laptop sitting in a Texas residence can make an overseas operator look like a U.S.-based remote employee. That physical relay is at the core of the North Korean IT-worker schemes targeted in a coordinated Justice Department action announced on October 13, 2026.

Federal agents searched more than 40 Texas residences between September 21 and September 25, 2026, seizing approximately 187 laptops and keyboard-video-mouse (KVM) devices in Operation Lonestar Roundup. Separately, prosecutors charged 14 people in an Ohio case alleging that a network obtained remote jobs at more than 70 U.S. companies and generated more than $3 million for workers tied to the Democratic People’s Republic of Korea (DPRK).

The operation disrupts the scheme but does not fix the hiring-control problem. Seizing a laptop farm removes U.S. endpoints, and interrupting KVM access prevents an operator from using those devices. But the alleged scheme depended on stolen identities, fraudulent hiring materials, VPNs, proxy infrastructure, remote-access software, residential hosts, and payment transfers—not on any one house or batch of laptops.

The Texas searches did not produce announced arrests of the alleged hosts. The two announced arrests, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, belong to the separately charged Northern District of Ohio case. The allegations remain unproven, and all defendants are presumed innocent.

A laptop farm is a physical answer to a network-location check

The government’s description is specific about the mechanics. DPRK workers allegedly applied for remote roles under stolen or fabricated identities, then used VPNs and proxies to appear to work from within the United States. U.S.-based facilitators received laptops issued by victim employers, housed and configured them, installed remote-access tooling, and passed earnings to DPRK-controlled accounts.

KVM hardware makes the setup more than a generic remote-desktop arrangement. It gives a remote worker a way to interact with a real employer-issued machine located at a U.S. residential network. That can preserve the device, browser, and network signals an employer expects from its purported employee while the person performing the work is elsewhere.

The fraud places two risks inside the same employment relationship. The immediate harm is sanctions evasion and payroll fraud. The technical exposure is that a person hired under a false identity may gain authorized access to internal systems and sensitive data. The Justice Department says past DPRK remote-worker campaigns have involved data extortion and exfiltration of proprietary and sensitive company information.

“This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.”

The Ohio indictment alleges a scheme running from 2019 through approximately July 2025. Its victims included employers in health care, communications, cyber support, retail, and manufacturing across Ohio, 16 additional states, and the District of Columbia. Texas was an infrastructure concentration point, while the alleged employment and network-access footprint was national.

The charged scheme and the Texas seizure are related but distinct

The Justice Department charged Bostelle and Pena Carrillo with wire fraud, money laundering, and identity theft in a four-count indictment. Ten named defendants are based in China, while two additional defendants remain under seal. The charges allege that Bostelle and Pena Carrillo participated with the overseas workers and other co-conspirators in the multi-year employment fraud.

The allegations describe how the domestic side operated. Bostelle, 31, allegedly provided his own name and a fraudulent driver’s license to help a remote worker get hired. Pena Carrillo, 37, allegedly hosted laptops at his San Juan, Texas, home under different names and received roughly $190,000 from five employers. An uncharged Ohio co-conspirator identified as Trey Michael Nolte allegedly maintained about two dozen company laptops, installed remote-access software, and moved more than $320,000 through accounts established under false identities.

More than 25 Americans' identities were allegedly compromised in the Ohio scheme. The government says the roughly $3 million in revenue is believed to have reached sanctioned DPRK-controlled entities. The case is not a measurement of all DPRK remote-work activity; it is one charged network. Officials separately cited a Treasury estimate that the broader DPRK IT-worker model generated more than $800 million in fiscal year 2024.

Operation Lonestar Roundup has a broader scope. The FBI’s Texas actions targeted multiple known or suspected farms used by the group tracked by CrowdStrike as Famous Chollima, also known as WageMole. More than 100 of the approximately 187 seized devices reportedly came from North Texas. The Texas search activity can disrupt multiple employers at once, but it does not establish that every residence searched was knowingly operated by a criminal facilitator.

“Each laptop seized potentially represents one company that has hired a DPRK IT worker.”

A seized device may map to an employer relationship, but the supplied facts do not establish a one-to-one count of victim companies, workers, or compromised networks from the Texas operation alone.

The useful indicators are in the hiring and device workflow

The Justice Department’s October 13 announcement names 11 email accounts that employers are encouraged to add to their DPRK-worker detection indicators: Bright.star.me208@gmail.com, Merrttank.bz@gmail.com, randyryang@gmail.com, michaelb860102@gmail.com, assassinki211@gmail.com, dev.jerryyang@gmail.com, denis.turgenev2021@gmail.com, yesiree.cano825@gmail.com, thomasdenzelbrown@gmail.com, anthonyortega4592@gmail.com, and tyler.j.palmi38@gmail.com.

Those indicators are narrow and disposable; blocking them alone will not solve the problem. A more durable signal is a workflow that requires unusual accommodations: an applicant whose identity verification is performed by a stand-in, a device shipment that must be redirected, or an employer laptop that stays permanently online at a residential location controlled by someone other than the nominal employee.

CrowdStrike said operators have redirected employer laptops through several routes: filing fake theft reports to trigger replacement deliveries, cycling through residential addresses, claiming a last-minute move to divert a shipment, and abusing access to IT staffing roles to reroute devices. It also says public exposure has pushed operators toward spoofed device identifiers and, in some cases, reuse of identifiers across victim organizations.

The alleged use of U.S. facilitators has expanded as private-sector detection and law-enforcement pressure have increased. The Justice Department says workers are recruiting Americans to perform more tasks and sometimes subcontracting entire jobs to third-party foreign nationals. The FBI’s public warning describes facilitators being paid to appear on video during interviews, verify identities, accept shipments, take drug tests, or simply keep devices online. It also notes that facilitators may be recruited while under financial pressure and can face threats of violence.

This creates a defensive problem that cannot be assigned solely to HR or security. Identity proofing, interview verification, shipping controls, endpoint telemetry, and privileged-access management catch different parts of the same chain. A company that verifies only an initial identity but ignores where its issued device is received, connected, and remotely controlled leaves the relay intact.

Enforcement history points to domestic enablers

The October 13 action falls under the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which focuses on U.S.-based people who allegedly enable North Korean revenue-generation activity. The department says it previously announced actions under the initiative in June 2025, November 2025, April 2026, and May 2026.

Facilitators can face substantial punishment when prosecutors prove intent and conduct. Christina Chapman, an Arizona woman, received a 102-month sentence in July 2025 after pleading guilty to operating a laptop farm that generated more than $17 million for North Korea and affected more than 300 companies. Earlier in 2026, two New Jersey men received 108- and 92-month sentences in Massachusetts in connection with a scheme that generated more than $5 million, while two other facilitators from Tennessee and New York received 18 months each.

The State Department is offering potential rewards of up to $5 million for information supporting international efforts to disrupt DPRK illicit financial activity, including cybercrime, money laundering, and sanctions evasion. That figure is separate from the alleged payroll revenue in the Ohio case and should not be read as compensation for affected employers.

CrowdStrike assessed that the raids will likely slow Famous Chollima activity in the immediate areas but are unlikely to create long-lasting effects on their own. The model can move to other residences, facilitators, identities, and replacement hardware.

The operation removed 187 devices and their KVM access paths from service. Longer-term prevention depends on making it difficult for a fraudulent employee to pass identity checks, receive a corporate endpoint through a third party, and keep that endpoint behaving like a legitimate U.S. remote workstation.