On October 13, 2026, the Justice Department announced coordinated actions against remote IT work the department says funds North Korea. The release covers two tracks. One is an indictment in the Northern District of Ohio. The other is Operation Lonestar Roundup, FBI searches of laptop farms in Texas.
Between September 21 and September 25, 2026, the FBI searched more than 40 residences in Texas known or suspected to be laptop farms. Across the operation it seized about 187 laptops and KVM devices — keyboard, video, and mouse hardware that lets someone operate a computer from elsewhere. The release says those machines were company laptops hosted so workers could look as if they were in the United States, and that the revenue was for sanctioned weapons programs. CrowdStrike’s name for this set of workers and helpers is Famous Chollima. The Northern District of Texas, the FBI’s Dallas field office, and the FBI Cyber Division ran the Texas searches.
Snapshot
| Field | Detail |
|---|---|
| Announcement | Justice Department · Oct 13, 2026 |
| Texas searches | Sept 21–25, 2026 · more than 40 residences |
| Devices in the release | About 187 laptops and KVM devices |
| Group name DOJ cites | CrowdStrike’s Famous Chollima |
| Ohio indictment | Wire fraud, money laundering, identity theft · about $3 million · more than 70 employers |
| Status | Allegations. Defendants are presumed innocent |
The Ohio case is Sun Sheng Ming, et al. The release says U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested on that indictment. It charges additional people, including defendants described as China-based, and says two identities remain under seal. The conduct in the indictment is described as running from 2019 to about July 2025, producing more than $3 million from more than 70 U.S. employers in health care, communications, cyber support, retail, and manufacturing. That dollar figure is the indictment’s allegation for this case. It is not a count of every laptop seized in Texas in September 2026.
The release says the workers used stolen or fabricated identity documents and used VPNs and proxies so the jobs looked U.S.-based, and that U.S. facilitators received the company laptops at residences. This post does not repeat the email addresses the release lists, and it does not describe how a laptop was redirected or how remote-access software was installed. The FBI said it published a public service announcement the same day. Employers can read that announcement on the FBI’s site rather than a forwarded “indicator” mail.
What a reader can do with this
| Do | Why |
|---|---|
| Treat a job laptop’s shipping address as part of hiring | The release says facilitators received company machines at U.S. residences |
| Read the DOJ release and the FBI announcement | A newsletter sentence is not the charging document |
| Keep identity documents off a chat with a new “IT recruiter” | The indictment alleges stolen and fabricated identity documents |
| Type justice.gov | A mail that attaches “the laptop-farm indicators” is an easy lure |
A hardware key on a new hire’s account does not show who is sitting with the laptop if the machine is in someone else’s house. The release’s point is the location of the computer, not a consumer password reset.
MFA around this announcement
| Grade | Meaning |
|---|---|
| Pass | Google Authenticator or another open authenticator app is documented, and a hardware key is not |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| KnowBe4 learner login | Pass | No | Yes |
KnowBe4’s learner help names Google Authenticator, Authy, and LastPass. It does not name a YubiKey. That grade is the training company’s login. The October 24 KnowBe4 newsletter mentioned the Texas searches in a sentence. The login grade does not identify who has a laptop in a Texas residence, and it does not unsay the indictment.
justice.gov and fbi.gov are the announcement. We did not find a public YubiKey or Google Authenticator enrollment on those sites that would cover a company laptop hosted in a house.
Directory: MFA support directory · Email & Identity.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the Justice Department, the FBI, CrowdStrike, BleepingComputer, KnowBe4, and CBS News on October 24, 2026. 100% is the ideal — none reach it. These scores do not measure whether a company was one of the 70 employers.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| FBI | fbi.gov | 82% | −18 |
| Justice Department | justice.gov | 81% | −19 |
| KnowBe4 | knowbe4.com | 73% | −27 |
| BleepingComputer | bleepingcomputer.com | 63% | −37 |
| CrowdStrike | crowdstrike.com | 62% | −38 |
| CBS News | cbsnews.com | 43% | −57 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| fbi.gov | 75% | 45% | 100% |
| justice.gov | 80% | 45% | 90% |
| knowbe4.com | 75% | 45% | 68% |
| bleepingcomputer.com | 75% | 15% | 40% |
| crowdstrike.com | 65% | 100% | 37% |
| cbsnews.com | 25% | 15% | 40% |
Audit links: fbi.gov · justice.gov · knowbe4.com · bleepingcomputer.com · crowdstrike.com · cbsnews.com
crowdstrike.com is Transport 100% and Website 37%. cbsnews.com is Identity 25%. Type the DOJ host if a mail offers a “farm indicator pack.”
Website stack
Passive homepage + Certificate Transparency probes (October 24, 2026). Versions only.
| Domain | Stack note |
|---|---|
| justice.gov | Drupal 11, behind 11.4.11; DigiCert TLS expires 2027-04-14 |
| fbi.gov | CMS undetected; Amazon Trust TLS expires 2027-02-08 |
| crowdstrike.com | CMS undetected; Amazon Trust TLS expires 2027-03-28 |
| bleepingcomputer.com | CMS undetected; Sectigo TLS expires 2027-05-03 |
| knowbe4.com | HubSpot (vendor-managed); Amazon Trust TLS expires 2027-04-07 |
| cbsnews.com | CMS undetected; Sectigo TLS expires 2027-04-21 |
Blacklist and lookalikes
Email blacklist checks (public DoH, October 24, 2026): justice.gov, fbi.gov, crowdstrike.com, bleepingcomputer.com, knowbe4.com, and cbsnews.com were clear on mail/domain lists we can query. fbi.gov showed SPFBL on a web IP — shared-edge noise, not led.
justice.gov and fbi.gov had no BEC-staging row in this pass. The CrowdStrike scan returned 14 names with mail and no site.
| Lookalike | Technique | Signal |
|---|---|---|
| crowdstrike.cloud | TLD swap | BEC staging (NS + MX) |
| knoowbe4.com | doubled o | BEC staging (NS + MX) |
| bleeepingcomputer.com | extra e | BEC staging (NS + MX) |
knowbe4.ai points at KnowBe4. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener searches on October 24, 2026 for “Lonestar Roundup” and “Famous Chollima” returned no docket. A search for Bostelle returned United States v. Bostelle, E.D. Pa. 2:26-mj-01987, a magistrate matter filed October 9, 2026. The DOJ release describes the indictment as a Northern District of Ohio case. We did not read that magistrate file, and we are not treating the 2015 Western District of Washington bankruptcy of a different Bostelle as this case.
Related coverage
Sources: Justice Department, Oct 13, 2026 · CBS Texas, Oct 13, 2026 · BleepingComputer. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 24, 2026. Domain scores: audit.emailmenow.com only.