The US Department of Justice (DoJ) has disrupted the operations of the Famous Chollima threat group by arresting two suspects, charging 14 people and seizing nearly 187 laptops used in North Korean remote IT worker programs.
The famous Chollima (aka WageMole) is often tracked as a North Korean threat actor associated with fraudulent IT worker programs that generate revenue for the North Korean regime.
With North Korea subject to extensive international sanctions, its employees seek technology jobs at companies around the world, often using stolen, rented or fake identities.
In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrencies and other assets.
As part of an operation in Texas codenamed “Lonestar Summary“The FBI searched 40 homes suspected of hosting laptop farms between September 21 and 25.
Laptop farms are places where moderators provide employer-provided computers that North Korean IT workers access remotely to appear in the United States.
Law enforcement agencies seized approximately 187 laptops and KVM input devices used by prominent Chollima employees that cybersecurity firm CrowdStrike had been tracking since April 2025.
CrowdStrike researchers say DPRK IT employees used several methods to send the company-issued laptops to the “farm” instead of the address in the provided identification documents:
- File fake theft reports to arrange for replacement deliveries to the farm address
- Rotate through residential addresses to obscure the final destination
- Request last minute moves to reroute equipment during shipping
- Sometimes abuse their IT staff functions to secretly reroute shipments
CrowdStrike says The publicity has put pressure on activists and led them to increase their reliance on forging device identifiers or even reusing identifiers across various victim organizations.
While CrowdStrike acknowledges that actions like Lonestar Roundup are likely to have limited impact, the company called the operation “the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.”
The U.S. Department of Justice also released an Ohio indictment detailing a remote IT employee scheme that ran from 2019 to July 2025, affecting 70 companies in the country and netting North Korean threat actors approximately $3 million.
The workers used stolen or fake identities, VPNs, and proxy infrastructure to appear to be based in the United States, while their American intermediaries provided company-provided laptops, installed remote access software, and transferred the proceeds to DPRK-controlled accounts.
Authorities arrested two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, on charges of wire fraud, money laundering and identity theft.
Separately the The US Department of Justice announced similar charges against 12 Chinese defendants.
