---
title: DOJ/FBI disrupt DPRK remote IT worker "laptop farms" affecting 70+ U.S. companies | ctxsec
url: https://ctxsec.com/items/doj-famous-chollima-2026-10
description: ""
status: "confirmed (DOJ)"
published: 2026-10-13
---

> 

[← Industry News](/industry) · [markdown](/items/doj-famous-chollima-2026-10.md)

confirmed (DOJ)

2026-10-13

### DOJ/FBI disrupt DPRK remote IT worker "laptop farms" affecting 70+ U.S. companies

DOJ (Oct 13) announced coordinated actions against North Korean remote IT-worker schemes: a Northern District of Ohio indictment charging 14 people (two U.S. facilitators arrested, Michael James Bostelle and Juan Cecilio Pena Carrillo) over a scheme hitting 70+ U.S. employers for about $3M, plus "Operation Lonestar Roundup": FBI searches of 40+ suspected Texas laptop farms (Sept 21-25) and seizure of about 187 laptops and KVM devices. DOJ published scheme-linked email indicators, the FBI issued a new PSA, and CrowdStrike (which tracks the group as FAMOUS CHOLLIMA) described its assistance. Defender takeaway: identity proofing for remote hires, geolocation/device anomalies on corporate endpoints, and vendor/contractor access reviews remain high priority.

Sources: [DOJ press release](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker) · [CrowdStrike blog](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/) · [FBI/IC3 PSA](https://www.ic3.gov/PSA/2026/PSA261013)