DOJ charges 14 over North Korean IT-worker laptop farms
An Ohio indictment charges 14 over the North Korean IT-worker scheme: stolen identities used to land remote US jobs, ~$3M from 70+ companies, and 187 computers seized in Texas.
A newly unsealed indictment in the Northern District of Ohio charges 14 people in connection with the North Korean IT-worker scheme — the long-running fraud in which DPRK operatives use stolen or fabricated identities to land remote jobs at US companies and funnel wages back to the regime. The case is reported by The Record and CyberScoop, both citing the indictment.
Who's charged
- Michael James Bostelle (Pennsylvania) and Juan Cecilio Pena Carrillo (Texas), both US citizens, were arrested and charged with wire fraud, money laundering, and identity theft.
- Ten of the defendants are described as located in China; two others are unnamed.
- Trey Michael Nolte (Ohio) is named as a co-conspirator who allegedly ran a shell company facilitating the scheme, but was not charged. The DOJ did not explain why.
How it worked and the money
North Korean workers obtained remote IT jobs using stolen identities, while US-based hosts ran "laptop farms" — racks of company-issued laptops kept online so the workers appeared to be logging in domestically. Per the indictment, the operation collected about $3 million from more than 70 US companies between 2019 and 2025, across sectors including healthcare, cybersecurity, retail, and manufacturing. Prosecutors say Nolte moved more than $320,000 through accounts opened under false names, and Pena Carrillo received about $190,000 from five employers.
Law enforcement searched more than 40 residences in Texas and seized roughly 187 computers. This is not a one-off: authorities raided nearly 30 laptop farms across 16 states the previous year.
"This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities." — Ryan Raybould, US Attorney, Northern District of Texas (via CyberScoop)
The FBI also warns that the scheme is adapting: North Korea now subcontracts work to freelancers in South Asia and West Africa, targets low-income Americans and active-duty military to host laptops, and in some cases workers have used threats of violence and data-leak extortion to extract payment.
Action checklist
If you hire remote engineers, you are in scope. Concrete controls:
- Harden identity verification at hire. Require live video that matches government ID, and treat reluctance to appear on camera, lip-sync lag, or AI-assisted video as disqualifying signals.
- Flag logistics red flags. A new hire asking to ship the corporate laptop to an address different from their stated residence — especially a freight-forwarder or a cluster address reused across hires — is the laptop-farm pattern.
- Instrument remote access. Alert on KVM-over-IP hardware, remote-desktop tools layered on the corporate laptop, and impossible-travel between the claimed location and the login origin.
- Reconcile payroll destinations. Watch for salaries routed to payment platforms or accounts that don't match the employee's stated identity or jurisdiction.
- If you find one, preserve and report to the FBI (ic3.gov) rather than quietly offboarding — these are active criminal investigations.
Context
The DPRK IT-worker program is now a standing revenue pipeline, not a novelty, and the indictment's own tally — dozens of laptop farms raided year over year — shows enforcement is playing whack-a-mole against a scheme that simply re-hosts. For practitioners the defensive center of gravity has moved left, into HR and IT onboarding, where a fabricated identity either gets caught at the door or becomes a paycheck for a sanctioned regime.