The U.S. Department of Justice has moved to dismantle the Famous Chollima threat group, also known as WageMole, by arresting two suspects, charging 14 individuals, and confiscating approximately 187 laptops that were part of North Korean remote work operations. The group has long been tracked by cybersecurity researchers as a state-linked actor running fraudulent IT employment schemes designed to funnel revenue to the DPRK regime.

North Korea's extensive exposure to international sanctions has driven its operatives to seek legitimate-appearing technology positions at companies across the globe. These workers typically operate under stolen, rented, or fabricated identities. Beyond simply collecting paychecks, some have targeted employer networks to exfiltrate confidential information, introduce malicious code, or siphon cryptocurrency and other valuable assets.

Operation Lonestar Roundup

Between September 21 and 25, the FBI executed a coordinated operation dubbed "Lonestar Roundup" that involved searches of 40 residences in Texas suspected of operating as laptop farms. These facilities serve as physical locations where intermediaries maintain employer-provided computers that remote North Korean operatives access to simulate a U.S. presence.

Agents recovered roughly 187 laptops along with KVM input devices used by Famous Chollima operatives. Cybersecurity firm CrowdStrike had been monitoring the group's activities since April 2025.

Methods used to redirect equipment

CrowdStrike researchers documented several tactics that DPRK workers employed to route company-issued devices to the farms rather than the addresses listed in their fabricated identity documents:

  • Filing fraudulent theft claims to obtain replacement devices shipped to the farm location
  • Cycling through multiple residential addresses to obscure the ultimate destination
  • Reporting sudden relocations to intercept shipments before final delivery
  • Leveraging IT staffing positions to secretly alter shipping instructions

Following public disclosure of these schemes, CrowdStrike noted that operatives have shifted tactics, increasingly relying on spoofed device identifiers or reusing the same identifiers across multiple victim organizations.

Despite acknowledging that operations like Lonestar Roundup will likely produce only limited disruption, CrowdStrike characterized the action as "the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima's U.S. infrastructure."

Scale of the scheme

The Department of Justice released an indictment from Ohio detailing a remote IT worker operation that functioned from 2019 through July 2025. The scheme targeted 70 U.S. companies and generated approximately $3 million in proceeds for North Korean actors.

Operatives used stolen or created identities, virtual private networks, and proxy systems to present themselves as U.S.-based employees. American facilitators hosted the company-provided equipment, deployed remote access tools, and channeled earnings to accounts controlled by the DPRK.

Arrests and charges

Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested and face charges of wire fraud, money laundering, and identity theft. The DoJ separately announced matching charges against 12 Chinese defendants.