North Korean operatives used stolen identities and American intermediaries to obtain remote jobs at more than 70 U.S. companies, generating approximately $3 million in revenue, according to federal prosecutors. The Justice Department has announced arrests, criminal charges and searches targeting a network that helped the workers conceal their locations.
The October 13, 2026, Justice Department announcement detailed two arrests, charges against 14 individuals and the seizure of approximately 187 laptops and related computer devices. Federal agents also searched more than 40 Texas residences suspected of supporting North Korean remote IT worker operations.
How North Korean IT Workers Entered U.S. Companies
Prosecutors say the operation relied on stolen or fabricated American identities, misleading online profiles and remote-access technology to secure legitimate IT positions. Once hired, the workers directed company-issued laptops to U.S. addresses controlled by facilitators rather than receiving the computers themselves.
These locations, known as laptop farms, allowed operatives overseas to access corporate computers while appearing to work in the United States. American facilitators maintained the equipment, installed remote-access software and helped transfer earnings to accounts controlled by North Korean entities.
The alleged employment scheme operated from 2019 through about July 2025 and affected companies in healthcare, communications, cybersecurity support, retail, and manufacturing. Victims were located across Ohio, 16 additional states and Washington, D.C.
Federal prosecutors identified two arrested American suspects as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both were charged in connection with an alleged conspiracy involving wire fraud, money laundering and identity theft, alongside several defendants based in China.
FBI Investigation Targets North Korean Operations
During Operation Lonestar Roundup, the FBI conducted coordinated enforcement actions in Texas between September 21 and 25. Cybersecurity company CrowdStrike assisted the FBI with threat intelligence and technical analysis involving the North Korean operation it tracks as Famous Chollima.
CrowdStrike documented tactics used to redirect company-issued computers, including false reports of stolen equipment and fabricated address changes. Some operatives also secured positions through staffing agencies, making it harder for employers to identify fraudulent applicants.
FBI Warns of Expanding Recruitment Tactics
In a separate public security advisory, the FBI warned that thousands of North Korean-controlled IT workers are targeting Western companies. The agency said operatives increasingly recruit Americans to participate in interviews, verify false identities and provide access to professional networking accounts.
Some workers have also begun subcontracting entire jobs to freelancers in other countries, making their involvement harder to detect. The FBI warned that these schemes can expose employers to intellectual property theft, data extortion and unauthorised access to sensitive systems.
The Justice Department said the operations generate revenue for sanctioned North Korean entities, including those connected to the country’s weapons programs. The latest enforcement action is part of a broader federal effort to disrupt the financial and technical networks supporting these schemes.
Federal authorities urged companies to strengthen identity verification and monitor suspicious remote-access activity throughout employment. The FBI emphasised that employers should evaluate multiple warning signs rather than rely on individual indicators that could incorrectly flag legitimate workers.
