DOJ and FBI Unveil New Indictment, Texas Raids Targeting North Korean Remote IT Worker Fraud

The Justice Department and the FBI announced Tuesday a coordinated set of actions against North Korea's long-running scheme to place operatives in remote information-technology jobs at American companies, disclosing an indictment in Ohio and a separate raid of dozens of so-called "laptop farms" in Texas. The actions, described in a Justice Department announcement, represent the latest escalation in a years-long campaign by federal authorities to choke off a revenue stream that officials say helps fund North Korea's weapons programs.

Prosecutors in the Northern District of Ohio unsealed a four-count indictment charging 14 people, including two U.S. citizens who were arrested, with wire fraud, money laundering and aggravated identity theft. Separately, in what the department labeled Operation Lonestar Roundup, FBI agents searched more than 40 residences across Texas between Sept. 21 and Sept. 25, seizing roughly 187 laptops and keyboard-video-mouse switching devices used to let overseas workers control company-issued computers from thousands of miles away.

The numbers

The Ohio indictment alleges the scheme generated more than $3 million in fraudulent revenue between 2019 and mid-2025, funneled toward accounts controlled by the North Korean government. Prosecutors say the fraud touched more than 70 U.S. employers in Ohio, 16 other states and the District of Columbia, in industries including health care, telecommunications, cybersecurity support, retail and manufacturing. The two arrested defendants are identified as Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas; ten additional defendants are listed as China-based nationals, and two more remain under seal.

The scale of the broader problem is larger still. A 2022 advisory from the FBI, Treasury Department and State Department, still posted on the Treasury's sanctions website, estimated that individual North Korean IT workers can earn up to $300,000 a year, with the collective scheme generating hundreds of millions of dollars annually for Pyongyang. CrowdStrike, the cybersecurity firm that assisted the FBI on the Texas raids, tracks the cluster behind much of this activity under the name "Famous Chollima" and called the farms "vital" infrastructure that lets North Korean operatives sidestep the physical, financial and legal barriers of not actually being in the United States, according to a company blog post on the operation.

How the scheme works

The fraud follows a now-familiar pattern that federal investigators have documented for several years. North Korean IT workers, posing as American remote employees using stolen or fabricated identities, apply for and win legitimate technology jobs at U.S. firms, often maintaining realistic LinkedIn profiles and email histories to pass screening. Once hired, their employer ships a company laptop to a U.S. address. Rather than going to the worker, the laptop goes to an American facilitator's home — a "laptop farm" — where it is fitted with remote-access software or hardware switches so the actual worker, operating from China, Russia or North Korea itself, can log in and perform the job as if sitting at the machine.

The Justice Department said the pattern described this week is evolving: workers are now recruiting American facilitators for a wider range of tasks beyond simply hosting hardware, and in some cases subcontracting entire jobs to other foreign nationals. The department's reporting on the announcement noted that beyond collecting salaries, some workers have gone on to steal sensitive company data and intellectual property, then used that access to extort additional payments from victim employers. Tuesday's cases are part of what the department calls its DPRK RevGen: Domestic Enabler Initiative, a joint effort between the National Security Division and the FBI's Cyber and Counterintelligence Divisions that has produced prior rounds of charges in June and November of 2025 and again this spring.

Who is affected

The direct victims are the employers who unknowingly hired North Korean operatives and absorbed the costs of legal fees, network remediation and, in some cases, data theft. The Justice Department has not named the affected companies, describing them only by sector. A second set of victims are the ordinary Americans whose identities were stolen to make the fraudulent hires look legitimate; the FBI has previously said such identity theft is often discovered only after a victim's credit or tax records are affected. The FBI's public advisory lists eleven Gmail addresses tied to the scheme and urges companies' security and hiring teams to add them to their own detection lists.

Reaction

Officials framed the actions as both a law-enforcement and a national-security matter. Assistant Attorney General John A. Eisenberg, who leads the department's National Security Division, said the government would use "every available tool" against anyone who helps North Korea raise money this way, warning that the scheme threatens the integrity of U.S. information systems and sensitive data. David M. Toepfer, the U.S. Attorney for the Northern District of Ohio, said the indictment should put employers on notice.

"These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices."

Ryan Raybould, the U.S. Attorney for the Northern District of Texas, cast the Texas raids in similar terms, saying a foreign regime had infiltrated American companies "through stolen identities" and that each laptop farm dismantled cuts off a revenue stream for North Korea. FBI Cyber Division Assistant Director Brett Leatherman credited the private sector for helping drive the case, saying close coordination between industry and federal law enforcement was central to the operation.

What happens next

Ten of the fourteen Ohio defendants are described in the indictment as China-based nationals, and two additional defendants remain under seal, meaning the great majority are unlikely to face a U.S. courtroom any time soon absent extradition. The Justice Department said the broader investigation remains active and that further arrests or charges are possible. The FBI's accompanying public service announcement lays out mitigation steps for employers, including stronger identity verification during remote hiring and monitoring for the kind of KVM hardware used to disguise a worker's true location. The State Department separately maintains a standing reward of up to $5 million through its Rewards for Justice program for information that disrupts North Korea's illicit financial networks, underscoring that Washington views this as an unresolved and ongoing threat rather than a closed case.