The US Department of Justice (DOJ) has announced coordinated enforcement actions against an alleged North Korean remote-work fraud scheme. According to reports it affected more than 70 American companies. The operation resulted in two arrests, an indictment charging 14 individuals and the seizure of approximately 187 computer devices.
The network used stolen identities, fraudulent job applications and US-based intermediaries. The aim was to secure remote IT jobs and channel earnings to North Korean-controlled entities.
According to the DOJ, “North Korean IT workers obtained remote positions at US companies by using stolen or fabricated identity documents. They allegedly relied on virtual private networks (VPNs), proxy infrastructure and fraudulent online accounts to appear as US-based employees.”
The alleged scheme operated from 2019 until around July 2025. Investigators said, “It affected businesses in healthcare, communications, cybersecurity support, retail and manufacturing across Ohio, 16 other states and the District of Columbia.”
Authorities estimate that the operation generated approximately USD 3 million in revenue. Investigators believe the money reached sanctioned entities controlled by North Korea, helping finance the regime's activities, including weapons programs.
As part of Operation Lonestar Roundup, the FBI searched more than 40 residences in Texas between September 21 and 25. Investigators seized approximately 187 laptops and keyboard-video-mouse (KVM) devices allegedly used to facilitate the scheme.
The DOJ announced the arrests of Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both face charges linked to wire fraud, money laundering and identity theft. The indictment also names 10 individuals based in China, while two additional defendants remain unidentified under seal. Looking ahead, the DOJ stressed that the charges remain allegations. All defendants are presumed innocent unless proven guilty in court.
Also Read: Mistral CEO Says New AI Model Beats Chinese Rivals in Cybersecurity