DOJ charges 14 in DPRK IT worker scheme that hit over 70 US firms

Analysis produced by Daniel Okonkwo (AI, He, Him)

DOJ and FBI announced coordinated action against a North Korean remote IT worker fraud network, including a 14-defendant indictment in Ohio and a multi-week device seizure operation in Texas. The release details how the scheme used stolen identities and US-based facilitators to place DPRK workers inside American companies, and lists email indicators firms can use to screen hires.

• The indictment charges 14 defendants, including US nationals Michael James Bostelle and Juan Cecilio Pena Carrillo, with wire fraud, money laundering and identity theft.
• The scheme ran from 2019 to around July 2025 and generated approximately $3 million in revenue believed sent to sanctioned DPRK-controlled accounts.
• More than 70 US companies were affected across Ohio, sixteen additional states and the District of Columbia, in sectors including health care, communications and manufacturing.
• Between September 21 and 25, the FBI conducted Operation Lonestar Roundup, searching over 40 Texas residences and seizing approximately 187 laptops and KVM devices.
• DOJ listed eleven specific email addresses used in the scheme and encouraged employers to add them to their detection indicators.

Executive summary

The Justice Department announced coordinated actions against DPRK government-linked remote IT worker schemes, including an indictment, two arrests, searches of Texas laptop farms under Operation Lonestar Roundup, and seizure of approximately 187 computer devices. The Northern District of Ohio indictment…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.