司法部瓦解朝鲜远程IT人员计划：14人被起诉、两名美国人被捕，德州“笔记本电脑农场”查获约187台设备
美国司法部 10 月 13 日宣布针对朝鲜政府远程 IT 人员计划的协调行动：俄亥俄北区联邦检察官办公室公布一份四项罪名的起诉书，共指控 14 名被告；两名美国公民被捕；联邦调查局（FBI）在德克萨斯州搜查 40 多处被指用作“笔记本电脑农场”（laptop farms）的住所，查获约 187 台笔记本电脑及 KVM（键盘、显示器、鼠标切换）设备。
被捕的两人是宾夕法尼亚州的迈克尔·詹姆斯·博斯特尔（Michael James Bostelle）与德克萨斯州的胡安·塞西利奥·佩纳·卡里略（Juan Cecilio Pena Carrillo）。起诉书另指控 10 名位于中国的中国公民：孙胜明、裴立光、翁守成、韩国斌、王建军、盛章坤、张伟平、张丽平、于洋与金龙；另有两名被告的身份暂未公开。所控罪名包括电信欺诈共谋、洗钱共谋、身份盗窃共谋与加重身份盗窃。
司法部称，2019 年至 2025 年 7 月前后的数年间，朝鲜 IT 人员使用盗用或伪造的身份文件，借助虚拟专用网络与代理基础设施，冒充身处美国的人员，取得美国公司的远程职位；美国境内的协助者则在自家住所接收并托管受害公司配发的笔记本电脑——即所谓“笔记本电脑农场”——安装远程访问软件，并把收入转移至朝鲜控制的账户，以换取收益分成。该计划波及 70 多家美国公司雇主，涉及医疗、通信、网络支持、零售与制造等行业，分布于俄亥俄州、另外 16 个州及华盛顿特区；海外 IT 人员由此获得约 300 万美元收入，司法部称这些资金据信被汇往受制裁的朝鲜控制实体。
这次德州行动代号“孤星围捕”（Operation Lonestar Roundup），FBI 于 9 月 21 日至 25 日执行搜查。FBI 表示，美国网络安全公司 CrowdStrike 将这批朝鲜 IT 人员及其协助者标识为“Famous Chollima”；FBI 同日发布公共服务公告，向美国公司说明这一威胁的识别与防范要点。
国家安全事务助理司法部长约翰·A·艾森伯格（John A. Eisenberg）表示：“朝鲜这个流氓政权利用其无处不在的 IT 人员计划为各种非法目的筹集资金，包括开发最终可能瞄准美国或其盟友的武器。”他表示，司法部国家安全司将与执法伙伴动用一切工具，追查任何协助朝鲜的人。
司法部表示，起诉书中的内容仅为指控，所有被告在法庭证明有罪之前均推定无罪。
（来源：美国司法部新闻稿，2026 年 10 月 13 日）
DOJ Disrupts North Korean Remote IT Worker Schemes: 14 Indicted, Two Americans Arrested, About 187 Devices Seized in Texas
The Justice Department on October 13 announced coordinated actions against North Korea's remote IT worker schemes: the U.S. Attorney's Office for the Northern District of Ohio unsealed a four-count indictment charging 14 defendants; two U.S. citizens were arrested; and the FBI searched more than 40 Texas residences believed to operate as “laptop farms,” seizing approximately 187 laptops and KVM (keyboard, video, mouse) devices used by DPRK IT workers.
The two arrested are Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. The indictment also charges 10 Chinese nationals based in China — Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long — while the identities of two additional defendants remain under seal. The charges include wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft.
According to the department, from 2019 to in or around July 2025, North Korean IT workers used stolen or fabricated identity documents, VPNs and proxy infrastructure to appear to be U.S.-based workers and obtain remote positions at U.S. companies, while U.S.-based facilitators received and hosted victim companies' laptops at their homes — the “laptop farms” — installed remote-access software and transferred earnings to DPRK-controlled accounts in exchange for a share of the proceeds. The scheme impacted more than 70 U.S. company employers in sectors including health care, communications, cyber support, retail and manufacturing, across Ohio, 16 additional states and the District of Columbia, and generated approximately $3 million in revenue that prosecutors say is believed to have been sent to sanctioned DPRK-controlled entities.
In “Operation Lonestar Roundup,” the FBI conducted the Texas searches between September 21 and 25. The FBI said U.S. cybersecurity firm CrowdStrike has identified this group of DPRK IT workers and their helpers as “Famous Chollima,” and the FBI on the same day published a public service announcement with guidance for U.S. companies on detecting the threat.
“North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg. He said the National Security Division and its law enforcement partners will use every available tool to track down anyone assisting the DPRK.
The department noted that the details in the court documents are merely allegations, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
(Source: U.S. Department of Justice press release, October 13, 2026)
图片来源：图：桌上多台笔记本电脑（示意）。摄影：.imelda，CC BY-SA 2.5，来源：Wikimedia Commons
