The US Justice Department announced on 13 October an indictment charging fourteen people over a North Korean remote IT worker scheme, two arrests, searches of more than forty suspected laptop farms in Texas, and the seizure of approximately 187 laptops and KVM devices.

The searches, run as Operation Lonestar Roundup, happened between 21 and 25 September. The announcement came almost three weeks later.

At the end of the release is a list of eleven fraudulent email accounts identified during the investigation, published so that companies can check their own records against them. That list is the most immediately useful thing in the document, and it says something about this threat that the seizure totals do not.

What the indictment alleges

The case is captioned Sun Sheng Ming, et al., in the Northern District of Ohio, and it is a four-count wire fraud, money laundering and identity theft indictment. The alleged conduct runs from 2019 to in or around July 2025.

Two of the fourteen are US nationals and both have been arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten more are described as China-based and named in the release. Two defendants' identities remain under seal.

The scheme allegedly reached more than 70 US company employers, across Ohio, sixteen other states and the District of Columbia, in health care, communications, cyber support, retail and manufacturing. It generated more than $3 million in revenue, which the department says is believed to have been sent to sanctioned entities controlled by the DPRK. The release cites a May 2022 advisory noting that such workers "have been known individually to earn up to $300,000 annually".

CrowdStrike tracks the group behind this category of activity as Famous Chollima.

The charges are allegations. The release states it plainly: "All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law."

Why the email addresses are the interesting part

We are not reprinting the eleven addresses. They are ordinary Gmail accounts built around plausible American names, the whole scheme runs on stolen and fabricated identities of real people, and the list sits one click away in the department's own release for anyone who needs to run it against their records. Reproducing it here would spread eleven name-shaped strings with no way for a reader to tell which are inventions and which are the identities of people who were themselves victims.

What matters is what the list implies. There is no malware in this announcement. No CVE, no intrusion, no exploited appliance. The access was granted through a hiring process, the equipment was shipped to a residential address in Texas by the employer, and a KVM device let somebody overseas use it as though they were sitting in front of it.

That means the detection surface is not the security team's. It is recruitment records, payroll, equipment shipping addresses and remote access patterns. An email address is a useful indicator here precisely because the thing being searched is an applicant tracking system rather than a firewall log.

We covered the other end of this in July, when a fake crypto startup turned out to have hired North Korean IT workers without realising it. The pattern has not changed. The scale of the response has.

The timing is worth noticing

The conduct charged ends in July 2025. The searches happened in late September 2026. The announcement came in October 2026.

None of that is unusual for a federal case, and all of it is worth holding in mind when reading the seizure figures. One hundred and eighty-seven machines is a snapshot of what was in forty-odd houses on four days in September, not a measure of how many are running now. The FBI's own assistant director described it as nearly 190 devices; the release gives approximately 187 in one place and approximately 187 laptops and KVM devices in another. These are counts of hardware in rooms, not of compromised employers.

The department has not named the victim companies, and more than seventy of them exist.

What to do

  • Run the eleven published addresses against your applicant tracking system, HR records, payroll and contractor onboarding, going back several years. The release exists so that you can.
  • Check whether any employee or contractor's company equipment ships to an address that does not match where they say they work, and whether more than one person's equipment goes to the same one.
  • Look for remote access that arrives through commercial VPNs or residential proxies, and for hardware-level remote control such as an unexplained KVM on the network path to a laptop.
  • Treat identity verification at hire as a security control, not an HR formality. This scheme defeats everything downstream of it.
  • If you find something, the relevant point of contact is the FBI field office, not a takedown request. There is an open case.

What is not established

  • Which companies were affected. The department has not named them.
  • Whether any of the roles involved access to source code, customer data or production systems. The release describes employment and payment, not what the workers touched.
  • How much of the more than $3 million has been recovered or traced beyond the allegation that it went to DPRK-controlled entities.
  • How many of the seized devices were active, and how many employers are still running one.
  • What happens to the two sealed defendants, and whether the ten named China-based defendants will ever be in a US court.
  • Whether the eleven published addresses are the full set known to investigators or the subset they chose to release.