Federal prosecutors announced a coordinated takedown of a North Korean remote IT worker network on October 13. An Ohio indictment charges 14 people, including ten defendants based in China and two under seal, with wire fraud, money laundering and identity theft. Two American facilitators, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. Agents searched more than 40 residences in Texas suspected of operating as laptop farms and seized about 187 laptops and related devices, the largest such haul disclosed so far.
The alleged scheme ran from 2019 to about July 2025. North Korean workers used stolen or fabricated US identities to win remote jobs at more than 70 American companies across healthcare, communications, retail, manufacturing and cybersecurity support, in Ohio, 16 other states and Washington, DC. Company laptops were shipped to the facilitators’ homes, where remote-access software let the overseas workers appear to be working inside the United States. Prosecutors put the revenue generated at about $3 million, routed to accounts controlled by North Korean entities.
The Justice Department’s warning was aimed at employers as much as at the network. It said the workers are recruiting American facilitators more aggressively to beat improved detection, and in some cases subcontracting whole jobs to other foreign nationals. CrowdStrike, which assisted the FBI, said the farms are central to how the operation defeats geographic and financial checks. The State Department is offering rewards of up to $5 million for information disrupting the scheme. For tech employers, the practical consequence is that hiring verification is now a sanctions control, not an HR formality.