U.S. authorities arrested Michael James Postel of Pennsylvania and Juan Cecilio Pena Carrillo of Texas in an operation targeting a fraudulent scheme that enabled North Korean IT workers to obtain remote jobs at U.S. companies. According to a four-count indictment, the scheme, which allegedly continued from 2019 through July 2025, generated more than $3 million in fraudulent revenue.
The two defendants, along with other conspirators, hosted and configured laptops provided by U.S. companies to employees who were supposedly working from within the United States. Using fake identities and an infrastructure of virtual private networks and proxies to conceal their real locations, the workers were able to appear to employers as U.S.-based employees. The indictment says they obtained jobs at more than 70 companies in the telecommunications, cyber support, healthcare, manufacturing, and retail sectors.
Dismantling U.S.-Based Operating Sites
In a separate operation called Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of being used as laptop farms. Authorities seized 187 laptops and KVM devices, equipment that enables remote control of computers and is believed to have been used to carry out the scheme.
Ten people residing in China were also charged for their alleged participation in the operation: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long.
How Do Computer Farms Operate?
CrowdStrike tracks this activity under the name Famous Chollima. According to the company, workers abroad use multiple methods to persuade employers to ship company devices to operating sites managed by facilitators in the United States. These methods include reporting computers as stolen to obtain replacement devices, claiming to have suddenly moved to another address, rotating multiple residential addresses, and using technology staffing companies to redirect end-client devices to those sites.
After the devices arrive, facilitators install software and equipment that allow workers abroad to access them remotely. As organizations strengthen their defenses, the group, according to CrowdStrike, has begun concealing remote-access tools, spoofing device fingerprints, and reusing the same device identifiers across different organizations and identities.
Why Does This Matter?
The operation shows that the scheme relies not only on direct technical compromise, but also on combining identity fraud, physical infrastructure, remote-management tools, and employment relationships. CrowdStrike says the victims included critical sectors such as aviation, energy, financial services, healthcare, cybersecurity, defense, government engineering, and consumer technology.
However, the company warns that dismantling computer farms may have a limited impact on Famous Chollima’s activity because these sites serve a physical, legal, and financial role that can be rebuilt elsewhere. The FBI also views the threat as extending beyond companies that hire remote workers, as IT workers induce Americans, knowingly or unknowingly, to perform services ranging from attending job interviews on their behalf and verifying fake identities to shipping packages and keeping work devices connected to the internet from their residences.
A Multilayered Verification Approach
The FBI recommends what it calls Identity in Depth, meaning the use of layers of access controls and mechanisms for continuous identity detection and verification throughout the employment lifecycle. Indicators cited by the bureau include the use of remote desktop software and remote monitoring and management tools, connecting external devices to control a computer, downloading applications unrelated to the job, data exfiltration, rotating bank accounts and physical addresses, and falsifying verification documents.
The practical idea is to combine multiple behavioral signals rather than rely on a single rule that can be easily bypassed. The source does not establish how successful these measures will be in preventing future schemes, and the charges in the case have not been adjudicated.