Federal officials have indicted 14 people and seized nearly 190 laptops in a crackdown on North Korean operatives who posed as American remote tech workers to fund the regime, according to the FBI.
The Justice Department has announced new charges and arrests tied to a scheme in which workers linked to North Korea’s government got hired for remote IT jobs at more than 70 U.S. companies using stolen or fake identities, according to the FBI.
An indictment unsealed in the Northern District of Ohio charges 14 people, including two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested. The remaining defendants are based in China. Prosecutors say the group ran the scheme from 2019 through July 2025, generating more than $3 million by placing North Korean IT workers in remote jobs at companies in health care, communications, retail, manufacturing and other sectors across 17 states and Washington, D.C.
According to the FBI, the workers used virtual private networks and stolen documents to appear as U.S.-based job applicants, while American facilitators hosted company-issued laptops in their homes, known as ‘laptop farms,’ and installed remote-access software so the real workers overseas could log in undetected.
Separately, the FBI’s Dallas field office led ‘Operation Lonestar Roundup,’ searching more than 40 suspected laptop farm locations across Texas between September 21 and 25 and seizing about 187 laptops and related devices.
FBI Cyber Division Assistant Director Brett Leatherman said the operation reflects close work between law enforcement and the private sector, noting the FBI ‘issued a Public Service Announcement with detailed mitigation guidance for U.S. companies.’
Officials say the money raised through these jobs is believed to support North Korea’s sanctioned weapons programs. The FBI’s Public Service Announcement also lists email addresses tied to the scheme that employers can use to help screen job applicants, and encourages companies to review their remote-hiring practices for warning signs.
Based on a release from FBI Cyber.
Source: FBI Cyber original release.
