Author: MIL-OSI Publisher

Posted on

Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies

Source: United States Department of Justice

Law Enforcement Actions in Ohio and Texas Result in Charges, Arrests, and Seizures of Approximately 187 Computer Devices

Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by DPRK IT workers. 

“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg. “These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft. NSD, along with our law enforcement partners, will use every available tool to track down anyone assisting the DPRK and to protect our national security.”

“Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Today, the FBI and DOJ announced a series of coordinated actions against this threat, securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected ‘laptop farms’ across Texas. Close coordination between the private sector and federal law enforcement was central to this operation. To further combat the threat, the FBI has issued a Public Service Announcement with detailed mitigation guidance for U.S. companies.”

Sun Sheng Ming, et al. Indictment and Arrests – Northern District of Ohio 

Today, the U.S. Attorney’s Office for the Northern District of Ohio announced the arrests of U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas pursuant to a four-count wire fraud, money laundering, and identity theft indictment. The indictment describes a multi-year fraud scheme by Bostelle, Pena, and their co-conspirators to obtain remote IT work with U.S. companies that generated more than $3 million in revenue. The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long for their roles in the scheme. The identities of two additional defendants remain under seal. 

According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts. 

In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.

The FBI Cleveland Field Office is investigating the case. Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the National Security Division’s National Security Cyber Section are prosecuting the case.

Operation Lonestar Roundup Disrupts Multiple Known or Suspected Laptop Farms in Texas

Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime’s sanctioned weapons programs. U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima.” 

Investigators discovered that the DPRK operatives allegedly used a network of fraudulent email accounts to facilitate their criminal activity. The following accounts were among those identified as being used in these schemes: 

Employers are encouraged to add these accounts to the list of indicators they use to identify and disrupt DPRK IT worker employment. 

Today, the FBI published a public service announcement describing the evolving DPRK IT worker threat, including tips on how to detect the threat. Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. Additionally, CrowdStrike today published a blog post describing its efforts at monitoring customer networks for DPRK IT worker activity and its successful collaboration with the FBI to disrupt this threat. 

The U.S. Attorney’s Office for the Northern District of Texas, the FBI’s Dallas Field Office, and the FBI’s Cyber Division coordinated Operation Lonestar Roundup. Valuable assistance was provided by the U.S. Attorney’s Office for the Northern District of Ohio.

Today’s announcements represent the Department’s latest actions to combat North Korean IT worker schemes as part of a joint NSD and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK’s illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in June 2025, November 2025, April 2026, and May 2026.

As described in Public Service Announcements published in May 2024, January 2025, July 2025, and today, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere. North Korean IT workers leverage these third parties, which include U.S.-based individuals, to gain fraudulent employment and access to U.S. company networks to generate this revenue.

Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a May 2022 advisory released by the FBI, Department of the Treasury, and Department of State; a July 2023 advisory from the Office of the Director of National Intelligence; and guidance issued in October 2023 by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s weapons programs.

The U.S. Department of State has offered potential rewards for up to $5 million in support of international efforts to disrupt the DPRK’s illicit financial activities, including for cybercrimes, money laundering, and sanctions evasion.

The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

Security News: Arizona Man Indicted on Assault Charges in Connection With Incident Resulting in Emergency Landing at Baltimore Airport

Source: United States Department of Justice

 Baltimore, Maryland – An Arizona man is facing indictment stemming from an attack of an airline passenger that forced an emergency landing at Baltimore/Washington International Thurgood Marshall Airport. Layne Lundeen, 67, of Tucson, is charged with interfering with flight crew members and attendants and assaulting those individuals by striking, beating, and wounding in connection with the incident.

Posted on

Security News: Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies

Source: United States Department of Justice

Law Enforcement Actions in Ohio and Texas Result in Charges, Arrests, and Seizures of Approximately 187 Computer Devices

Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by DPRK IT workers. 

“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg. “These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft. NSD, along with our law enforcement partners, will use every available tool to track down anyone assisting the DPRK and to protect our national security.”

“Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Today, the FBI and DOJ announced a series of coordinated actions against this threat, securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected ‘laptop farms’ across Texas. Close coordination between the private sector and federal law enforcement was central to this operation. To further combat the threat, the FBI has issued a Public Service Announcement with detailed mitigation guidance for U.S. companies.”

Sun Sheng Ming, et al. Indictment and Arrests – Northern District of Ohio 

Today, the U.S. Attorney’s Office for the Northern District of Ohio announced the arrests of U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas pursuant to a four-count wire fraud, money laundering, and identity theft indictment. The indictment describes a multi-year fraud scheme by Bostelle, Pena, and their co-conspirators to obtain remote IT work with U.S. companies that generated more than $3 million in revenue. The indictment also charges China-based Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, Jin Long for their roles in the scheme. The identities of two additional defendants remain under seal. 

According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts. 

In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.

The FBI Cleveland Field Office is investigating the case. Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the National Security Division’s National Security Cyber Section are prosecuting the case.

Operation Lonestar Roundup Disrupts Multiple Known or Suspected Laptop Farms in Texas

Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms for DPRK IT workers. Over the course of the entire operation (Operation Lonestar Roundup), the FBI seized approximately 187 laptops and KVM (keyboard, video, mouse) devices that DPRK IT workers and their U.S.-based facilitators used to commit fraud, obtain remote employment, and generate revenue for the North Korean regime’s sanctioned weapons programs. U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima.” 

Investigators discovered that the DPRK operatives allegedly used a network of fraudulent email accounts to facilitate their criminal activity. The following accounts were among those identified as being used in these schemes: 

Employers are encouraged to add these accounts to the list of indicators they use to identify and disrupt DPRK IT worker employment. 

Today, the FBI published a public service announcement describing the evolving DPRK IT worker threat, including tips on how to detect the threat. Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. Additionally, CrowdStrike today published a blog post describing its efforts at monitoring customer networks for DPRK IT worker activity and its successful collaboration with the FBI to disrupt this threat. 

The U.S. Attorney’s Office for the Northern District of Texas, the FBI’s Dallas Field Office, and the FBI’s Cyber Division coordinated Operation Lonestar Roundup. Valuable assistance was provided by the U.S. Attorney’s Office for the Northern District of Ohio.

Today’s announcements represent the Department’s latest actions to combat North Korean IT worker schemes as part of a joint NSD and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK’s illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in June 2025, November 2025, April 2026, and May 2026.

As described in Public Service Announcements published in May 2024, January 2025, July 2025, and today, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere. North Korean IT workers leverage these third parties, which include U.S.-based individuals, to gain fraudulent employment and access to U.S. company networks to generate this revenue.

Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a May 2022 advisory released by the FBI, Department of the Treasury, and Department of State; a July 2023 advisory from the Office of the Director of National Intelligence; and guidance issued in October 2023 by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s weapons programs.

The U.S. Department of State has offered potential rewards for up to $5 million in support of international efforts to disrupt the DPRK’s illicit financial activities, including for cybercrimes, money laundering, and sanctions evasion.

The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

Las Vegas Man Sentenced to 35 Years in Prison for Child Exploitation Offenses and Related Charges

Source: United States Department of Justice Criminal Division

LAS VEGAS – A Las Vegas man was sentenced today by United States District Judge Gloria M. Navarro to 420 months in prison, followed by 35 years of supervised release for sexual exploitation of children, coercion and enticement, and possession of child sexual abuse material (CSAM). The government recommended a sentence of 420 months in prison, followed by a lifetime term of supervised release.

Posted on

CVS Agrees to Pay $315M for Illegally Filling Unlawful Opioid Prescriptions and for Submitting False Claims to the Federal Government

Source: United States Department of Justice Criminal Division

CVS Pharmacy Inc., a Rhode Island-based pharmacy chain, and its related corporate entities (collectively, CVS) have agreed to pay $315 million to resolve allegations that, from October 17, 2013 through December 2, 2025, CVS illegally filled prescriptions for opioids and other controlled substances in violation of the Controlled Substances Act (CSA), and then sought payment for many of those invalid prescriptions from Medicare and other federal healthcare programs in violation of the False Claims Act (FCA). 

“Not only does this settlement hold bad actors accountable for their fraudulent activities, but Americans are safer because of it,” said Associate Attorney General Stanley E. Woodward Jr. “Today’s settlement is a significant milestone in the Justice Department’s efforts to combat the opioid epidemic by cracking down on pharmacies who unlawfully fulfill prescriptions for controlled substances.”

“Today’s settlement requires CVS to implement additional safeguards to ensure that prescriptions for opioids and other controlled substances are dispensed only when medically appropriate,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “The remedial measures in this agreement — including proactive monitoring of opioid prescribing patterns — will provide critical protections for patients and federal healthcare programs. The Department of Justice will continue to take steps to prevent the unlawful dispensing of opioids.”

“The opioid epidemic has affected families and communities across Rhode Island and throughout the nation,” said First Assistant U.S. Attorney Charles C. Calenda for the District of Rhode Island. “Pharmacies that dispense controlled substances must maintain effective compliance systems to identify and respond to warning signs that prescriptions may be unlawful or medically unnecessary. This settlement demonstrates the importance of those obligations and the consequences of failing to implement safeguards designed to prevent the improper dispensing of controlled substances.”

The settlement resolves allegations in the government’s complaint, which the United States filed on Dec. 13, 2024, in the U.S. District Court for the District of Rhode Island, that CVS knowingly filled prescriptions for controlled substances that lacked a legitimate medical purpose, were not valid, and/or were not issued in the usual course of professional practice. The United States alleged that CVS dispensed prescriptions for dangerous and excessive quantities of opioids, opioid prescriptions filled too early, and “trinity” prescriptions, a dangerous and abused combination of an opioid, a benzodiazepine, and a muscle relaxant. CVS also allegedly filled prescriptions for controlled substances from “pill mill” prescribers who issued large numbers of controlled substance prescriptions without any medical purpose. Further, the United States alleged that CVS pharmacists filled these prescriptions despite clear red flags indicating that there was a high likelihood that the prescriptions lacked a legitimate medical purpose, were not valid, or were not issued in the course of professional practice. Many of these prescriptions were ultimately billed to and reimbursed by federal healthcare programs.

The complaint further alleged that CVS’s violations stemmed from corporate-imposed performance metrics, incentive compensation, and staffing policies that prioritized corporate profits over patient safety. CVS failed to employ enough pharmacists to serve patients, comply with CVS’s legal obligations, and meet corporate performance metrics. In addition, CVS’s policies allegedly prevented pharmacists from warning one another about certain problematic prescribers.

In addition to the monetary payment announced today, CVS has entered into a memorandum of agreement with DEA to address its future obligations in dispensing controlled substances. This agreement requires CVS to establish a hotline for both employees and the public to report suspected illegal dispensing of controlled substances, proactively monitor the dispensing patterns of its pharmacies to identify and address potentially illegal dispensing, and establish a process to evaluate prescribers suspected of illegal prescribing.

“This settlement agreement highlights DEA’s commitment to protecting the health and safety of Americans while holding CVS accountable for dispensing unlawful prescriptions and endangering the public,” said DEA Assistant Administrator Cheri Oz. “DEA is unwavering in its commitment to protect public health and ensuring pharmacies adhere to the highest standards of responsible dispensing. We will continue to work closely with law enforcement, regulatory agencies, and the healthcare community to prevent the misuse of controlled substances, and we will hold those who jeopardize the safety of our citizens accountable.”

“Behind every unlawful prescription is a patient who could be put in harm’s way,” said Acting Deputy Inspector General for Investigations Scott J. Lampert of the U.S. Department of Health and Human Services Office of Inspector General (HHS‑OIG). “The allegations in this case point to warning signs that should never be overlooked. HHS‑OIG will not tolerate conduct that jeopardizes lives, and we will continue to pursue those who betray the trust placed in them.”

The civil settlement resolves a civil lawsuit filed by Hillary Estright, a former CVS employee, under the whistleblower provision of the FCA, which authorizes private parties to sue on behalf of the United States and receive a share of any recovery.  It also permits the United States to intervene and take over such lawsuits, as it did here. The amount to be recovered by the private whistleblower has not yet been determined.  The qui tam case is captioned United States ex rel. Hillary Estright v. CVS Health Corporation, et al., No. 22-cv-00222 (D.R.I.).

This year the Administration launched the Task Force to Eliminate Fraud and the National Fraud Enforcement Division to enhance the Administration’s war on fraud, waste, and abuse in federal programs. When unscrupulous actors exploit these programs for their own financial gain, they defraud the government, harm the people these programs are designed to aid and protect, and undermine American businesses that play by the rules. The Civil Division’s FCA enforcement plays a critical role in combatting such fraudulent schemes, recovering billions of dollars for the American taxpayers, and holding wrongdoers accountable. FCA matters will continue to be on the forefront of the battle against fraud, and the Civil Division’s FCA work will support and advance the mission of the Task Force to Eliminate Fraud and the National Fraud Enforcement Division.

The resolution obtained in this matter was the result of a coordinated effort between the Civil Division’s Commercial Litigation Branch, Fraud Section, and the Enforcement & Affirmative Litigation Branch, along with the U.S. Attorneys’ Offices for the District of Rhode Island, Eastern District of Virginia, Eastern District of Texas, and District of Hawaii. The DEA’s Office of Diversion Control, Los Angeles Field Division, Richmond District Office, and Office of Chief Counsel led this case with substantial assistance from Health and Human Services Office of Inspector General, Defense Criminal Investigative Service, Defense Health Agency (DHA), Office of Personnel Management (OPM), Department of Labor (DOL) Office of Inspector General, and the Department of Veterans Affairs (VA).

The investigation and resolution of this matter illustrate the government’s emphasis on combating healthcare fraud. One of the most powerful tools in this effort is the False Claims Act. Tips and complaints from all sources about potential fraud, waste, abuse, and mismanagement, can be reported to the Department of Health and Human Services at 800-HHS-TIPS (800-447-8477).

The United States is represented in this matter by attorneys from the Justice Department’s Civil Division Commercial Litigation Branch, Fraud Section (Assistant Director Natalie Waites and Trial Attorneys Claire Norsetter and Megan Engel) and Enforcement & Affirmative Litigation Branch (Deputy Director Lisa Hsiao and Trial Attorneys Kathleen Brunson and Katherine Ho), as well as from the U.S. Attorneys’ Offices for the District of Rhode Island (Assistant U.S. Attorney Rachna Vyas), Eastern District of Virginia (Assistant U.S. Attorney John Beerbower), Eastern District of Texas (Assistant U.S. Attorney James Gillingham), and District of Hawaii (Assistant U.S. Attorney Tracy J. Weinstein).

The claims resolved by the settlement are allegations only and there has been no determination of liability.

Note: Find the CSA agreement here and the FCA agreement here.