The **U.S. Department of Justice (DoJ)** has unveiled a coordinated effort to dismantle the operations of the **Famous Chollima** threat group, also known as **WageMole**. This North Korean state-sponsored actor is primarily known for orchestrating elaborate remote IT worker schemes designed to funnel illicit revenue back to the **DPRK regime**. ### The Modus Operandi of Famous Chollima Facing stringent international sanctions, North Korean operatives seek technology jobs globally, frequently employing stolen, rented, or fabricated identities. Beyond merely earning wages, these workers have been known to attempt network compromises, data theft, malware deployment, and cryptocurrency exfiltration from their employers. ### Lonestar Roundup: A Coordinated Strike Between September 21 and 25, the **FBI** executed "Operation Lonestar Roundup" in Texas, conducting searches at 40 residences suspected of housing "laptop farms." These locations serve as staging points where facilitators host employer-issued computers, allowing North Korean IT workers to remotely access them and appear to be based in the United States. Authorities seized approximately 187 laptops and **KVM** input devices during the raids. Cybersecurity firm **CrowdStrike**, which has been tracking **Famous Chollima** since April 2025, provided crucial assistance in this operation. ### Evading Detection: How Laptops Reached the Farms **CrowdStrike** researchers detailed several methods used by **DPRK** IT workers to divert company-issued laptops to these farms instead of the identity document's address: * Submitting false theft reports to trigger replacement shipments to the farm's address. * Rotating through various residential addresses to obscure the final destination. * Claiming last-minute relocations to divert devices mid-shipment. * Abusing IT staffing roles they sometimes held to covertly redirect shipments. **CrowdStrike** observes that increased public scrutiny has pushed operatives to rely more on spoofing device identifiers or even reusing identifiers across multiple victim organizations. While acknowledging that operations like Lonestar Roundup might have a limited long-term impact, **CrowdStrike** views it as "the beginning of a broader U.S. law enforcement effort to dismantle **Famous Chollima**’s U.S. infrastructure." ### Indictments and Arrests Simultaneously, the **DoJ** published an Ohio indictment detailing a remote IT worker scheme that operated from 2019 to July 2025. This scheme impacted 70 U.S. companies and generated approximately $3 million for the North Korean threat actors. The workers leveraged stolen or fabricated identities, **VPNs**, and proxy infrastructure to maintain the illusion of U.S. residency. Their American facilitators hosted the company-issued laptops, installed remote-access software, and transferred the illicit earnings to **DPRK**-controlled accounts. **Michael James Bostelle** and **Juan Cecilio Pena Carrillo**, two U.S. nationals, have been arrested and charged with wire fraud, money laundering, and identity theft. The **DoJ** also announced similar charges against 12 Chinese defendants in a separate but related action.