DOJ says North Korean IT workers fooled more than 70 US companies

On Tuesday, October 13, the Justice Department described a set of coordinated actions against what it calls North Korea's remote IT worker schemes.

• An indictment: unsealed in the Northern District of Ohio, with four counts of wire fraud, money laundering and identity theft.
• Two arrests: US citizens Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas.
• Raids: FBI searches at more than 40 homes in Texas, under the name Operation Lonestar Roundup.
• Seizures: about 187 laptops and KVM devices, the boxes that let one keyboard, screen and mouse control several computers.

The FBI's Brett Leatherman said the actions brought charges against 14 people in total.

When a company hires a remote worker, it usually mails them a work laptop. In this scheme, the laptop goes to a home in the US instead of to the real worker.

Someone at that home keeps the laptop plugged in and online. They install remote-access software, so the actual worker, sitting far away, can control it as if they were at the desk.

It works a bit like a mail forwarding service, except what gets forwarded is the whole job. To the company, the laptop looks like it's in Texas. The person typing is somewhere else entirely.

According to the Justice Department, between September 21 and 25 the FBI searched more than 40 Texas homes known or suspected to be laptop farms for North Korean IT workers.

The indictment covers the period from 2019 to around July 2025. The Justice Department says the workers used stolen or made-up identity documents, VPNs and proxy servers to look like Americans working from inside the US.

US-based helpers did the rest. Prosecutors say they received laptops from victim companies, set them up at their homes, installed remote-access software and moved the workers' pay to accounts controlled by North Korea.

Prosecutors say the scheme reached more than 70 US employers and brought in about $3 million.

The victims were in health care, communications, cyber support, retail and manufacturing. They were spread across Ohio, 16 other states and Washington, DC. The Justice Department did not name any of the companies.

The indictment names the two arrested Americans and ten people based in China. Two more defendants remain under seal. All of them are presumed innocent until proven guilty in court.

CyberScoop, which read the indictment, describes what each American is accused of:

• Michael James Bostelle: gave his name and a fake driver's license to help a remote worker get a job.
• Juan Cecilio Pena Carrillo: hosted laptops at his home under several names and received about $190,000 from five employers.
• Trey Michael Nolte: an Ohio resident named as a co-conspirator but not charged. CyberScoop says he kept about two dozen company laptops online and moved more than $320,000 through accounts opened under false names.

The Record reports that the Justice Department did not explain why Nolte was not charged.

CyberScoop also reports that prosecutors say the men filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity theft victims.

The big picture: the Justice Department says the money goes to the North Korean government and its sanctioned weapons programs.

John Eisenberg, who leads the department's National Security Division, said the schemes raise money "for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies."

A 2022 government advisory, cited in the release, said a single North Korean IT worker could earn up to $300,000 a year. Together, these workers generate hundreds of millions of dollars a year, according to that advisory.

Remote jobs are not the only source. TechCrunch notes the regime is thought to have stolen at least $2 billion in cryptocurrency in 2025 alone.

The FBI published a new public service announcement alongside the charges. Its main warning: as companies get better at spotting fake hires, North Korean workers are paying more Americans to help.

According to the FBI advisory, as quoted by The Record, helpers are now paid to:

• appear on camera and sit job interviews or meetings;
• verify fake identities and lend their social media or professional networking accounts;
• ship packages and keep work laptops online at home;
• take drug tests or submit fingerprints.

The FBI also says some workers subcontract the actual job to freelancers, usually in Pakistan, India or Nigeria, for a fraction of the salary. The Record reports the FBI has seen workers discuss how to find Americans "facing financial stress."

The catch: CyberScoop says CrowdStrike has seen the group disguise hardware since May, for example making a video capture card show up as a webcam. Because these habits look like normal remote work, no single red flag catches them.

In real life If a stranger online offers to pay you to keep a few laptops plugged in at home, or to sit a video interview using someone else's name, that matches what the FBI describes as recruitment for this scheme. The safe move is to say no and report it to the FBI.

CrowdStrike, the security company, helped the FBI investigate. It calls this group of workers and helpers Famous Chollima.

TechCrunch reports that CrowdStrike calls laptop farms "vital" to North Korea, because they solve the problem of not physically being in the US.

CrowdStrike was also realistic about the effect. In its own post, quoted by CyberScoop, it said shutting down a laptop farm will likely have a limited impact, mostly tied to where the takedown happens. But it added that such operations show the group that investigators can see its infrastructure.

The Justice Department says this is part of a joint effort with the FBI called the DPRK RevGen: Domestic Enabler Initiative. It lists earlier actions in June 2025, November 2025, April 2026 and May 2026.

The Record notes that nearly 30 laptop farms across 16 states were raided last year, and that several Americans have already been sentenced to prison for similar roles.

The State Department offers rewards of up to $5 million for information that helps disrupt North Korea's money schemes. For another recent example of how security problems reach regular people, see how a data breach reached ASOS shoppers.

• If you hire remote workers: the FBI recommends layered identity checks during the whole job, not just at the interview, CyberScoop reports.
• If you get an odd side gig offer: hosting laptops or interviewing for someone else is exactly what the FBI warns about.
• If your identity was stolen: false records in victims' names were allegedly filed with the IRS and Social Security, so check your records if something looks off.