The arrested individuals have been identified as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas.

Announcing the arrests, the Department of Justice said the two men were taken into custody pursuant to a four-count indictment charging wire fraud, money laundering and identity theft.

According to the indictment, Bostelle, Pena and their co-conspirators allegedly operated a multi-year fraud scheme that generated more than $3 million in revenue by securing remote IT jobs with US companies.

The indictment also names 10 China-based defendants — Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long — who are accused of participating in the scheme. The identities of two additional defendants remain under seal.

According to the indictment, the alleged scheme operated from 2019 until around July 2025. During this period, North Korean IT workers allegedly applied for and obtained remote jobs using stolen or fabricated identity documents, virtual private networks (VPNs) and proxy infrastructure to make it appear that they were US-based workers.

The workers allegedly relied on US-based facilitators who received and hosted multiple laptop computers issued by victim companies at their residences. These setups, known as “laptop farms”, were used to house and configure the devices, install remote-access software and facilitate the transfer of earnings to accounts controlled by North Korea.

The scheme allegedly affected more than 70 US employers and generated approximately $3 million in revenue for the North Korean IT workers.

“The revenue is believed to have been sent to sanctioned entities controlled by the DPRK,” the department said.

The affected employers operated across several sectors, including healthcare, communications, cybersecurity support, retail and manufacturing. The companies were located in Ohio, 16 other US states and the District of Columbia.

The FBI's Cleveland Field Office is investigating the case.

Between September 21 and September 25, the FBI conducted searches and other law enforcement operations at more than 40 residences in Texas that were known or suspected to have been used as laptop farms for North Korean IT workers.

As part of the wider operation, known as Operation Lonestar Roundup, the FBI seized approximately 187 laptops and keyboard, video and mouse (KVM) devices allegedly used by North Korean IT workers and their US-based facilitators to commit fraud, obtain remote employment and generate revenue for the North Korean regime's sanctioned weapons programmes.

US cybersecurity firm CrowdStrike has identified the North Korean IT workers and their associates involved in the scheme as “Famous Chollima”.