Federal prosecutors have charged 14 people in a scheme that they say put North Korean IT workers into remote jobs at more than 70 American companies, and FBI agents have carried out searches and other enforcement actions at more than 40 Texas homes suspected of serving as laptop farms for such workers, the Justice Department announced Tuesday.
Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on a four-count indictment from the Northern District of Ohio charging wire fraud, money laundering and identity theft. The indictment also charges 10 defendants based in China. Two more defendants have not been publicly identified because their names remain under seal.
According to the indictment, North Korean workers spent years, from 2019 until around July 2025, landing remote positions with stolen or fabricated identity documents while routing their connections through virtual private networks and proxy servers so they would appear to be working from inside the United States. Facilitators in this country allegedly received the laptops that employers issued, kept them at their homes, installed remote-access software and sent the workers' pay on to accounts controlled by North Korea. The department said the scheme brought in about $3 million, money it believes went to sanctioned entities controlled by Pyongyang.
The employers that were deceived include health care, communications, cyber support, retail and manufacturing companies in Ohio, 16 other states and the District of Columbia. Citing the department, Reuters reported that the fraud also compromised the identities of 25 Americans and caused false information to be sent to multiple U.S. government agencies.
The Texas searches, part of what the department calls Operation Lonestar Roundup, ran from Sept. 21 to Sept. 25. Agents searched or took other action at more than 40 residences known or suspected to be laptop farms, and over the course of the operation they seized about 187 laptops and KVM devices. The FBI says North Korean workers use such keyboard, video and mouse hardware, connected over the internet, to control laptops remotely. The U.S. attorney's office for the Northern District of Texas, the FBI's Dallas field office and the bureau's Cyber Division coordinated the operation.
"Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability," said Ryan Raybould, the U.S. attorney for the Northern District of Texas. John A. Eisenberg, the assistant attorney general for national security, said the government in Pyongyang uses the schemes to raise money for illicit purposes, "including the development of weapons that could ultimately target the United States or its allies."
CrowdStrike, the cybersecurity company, said in its own account of the operation that its analysts worked alongside the FBI in late September to disrupt several laptop farms maintained by a North Korea-linked group it calls Famous Chollima. Victims across the disrupted networks, the company said, included organizations in aerospace, energy, financial services, health care, defense engineering and government technology. It described the takedowns as the start of a broader law enforcement push against the group's infrastructure in the United States, but it was also blunt about their limits. CrowdStrike wrote that the disruption would likely slow the group only where farms were shut down and was unlikely to have long-lasting effects, and that the operatives would almost certainly keep changing their methods to avoid detection.
The bureau paired Tuesday's announcement with a public warning that North Korean workers are paying Americans for a widening range of services that help hide who is really doing the job, from appearing on camera and taking part in job interviews to verifying fraudulent identities and keeping company laptops connected at home. The FBI said the North Koreans strategically seek out people under financial stress, and it estimates that North Korea's government receives 85 to 90 percent of what the workers earn. It urged employers to layer identity checks throughout a worker's employment while cautioning that aggressive screening can wrongly flag legitimate employees.
Tuesday's actions are part of the DPRK RevGen: Domestic Enabler Initiative, a joint effort of the department's National Security Division and the FBI's Cyber and Counterintelligence divisions aimed at North Korea's revenue schemes and the people in the United States who enable them. The department announced earlier actions under the initiative in June and November 2025 and in April and May of this year. A 2022 government advisory said individual North Korean IT workers have been known to earn as much as $300,000 a year, and that together they generate hundreds of millions of dollars annually for designated entities such as North Korea's Ministry of Defense.
"These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices," said David M. Toepfer, the U.S. attorney for the Northern District of Ohio, whose office is prosecuting the case with the National Security Division. The FBI's Cleveland field office is investigating.
The charges are allegations, and the defendants are presumed innocent unless proven guilty in court. Reuters said lawyers for Pena and Bostelle could not immediately be reached for comment.