Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.
The Department of Justice disrupted multiple laptop farms across Texas allegedly being used by North Korean nationals to facilitate an IT worker scheme that allows the country to earn millions from U.S. companies.
The laptop farm raids, which were conducted September 21-25, targeted more than 40 residences, the DOJ said.
Law enforcement seized 187 laptops and other devices used by North Koreans. Such schemes have earned millions over the last eight years by tricking U.S. companies into hiring workers remotely into lucrative IT roles through stolen or purchased identities.
Alongside the raids, the DOJ indicted and arrested U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Several Chinese and North Korean nationals also were indicted. The department did not respond to requests for comment about whether the indictments and arrests were linked to the Texas laptop farm raids.
The DOJ indicted Bostelle and Pena on wire fraud, money laundering, and identity theft charges, accusing them of being key U.S.-based cogs in the IT worker scheme.
Bostelle and Pena helped a group of North Koreans earn more than $3 million from about 70 U.S. companies across 17 states, prosecutors said, including organizations in healthcare, cybersecurity, retail and manufacturing.
Large parts of the indictment are centered around U.S. national Trey Michael Nolte, who was not charged.
The DOJ did not explain why he was not charged, but prosecutors said he ran a shell company that facilitated the scheme. Nolte allegedly communicated with Chinese and North Korean nationals, recruited Bostelle, sent packages to China, received work laptops from U.S. companies and laundered the paychecks earned by the IT workers back to North Korea.
From 2019 to 2026, Bostelle and Pena hosted laptops as part of the scheme while also helping IT workers obtain and use fake identification documents to obtain employment or verify bank accounts, prosecutors said
“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John Eisenberg.
“These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft.”
The actions outlined on Tuesday are part of a long-running operation to disrupt laptop farms across the U.S. as well as identify American co-conspirators who sell their identities for use or host laptop farms at their properties.
Nearly 30 laptop farms across 16 states were raided last year by U.S. law enforcement.
Several Americans have already been convicted and sentenced to years in prison for running laptop farms and coordinating with North Koreans on the IT worker scheme.
North Korean nationals funnel the money earned from high-paying IT roles into the country’s government.
Researchers have said several government agencies effectively fund themselves by employing their own coterie of IT workers. Many IT workers are located in China or Russia but a recent United Nations report found hundreds of North Korean IT workers in Laos, Cambodia and several other countries.
Changing tactics
Assistant FBI Director Brett Leatherman said North Korea “continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.”
Leatherman noted that the FBI released a new public service announcement describing the latest tactics used by North Korean IT workers to recruit Americans and perpetrate the scheme.
The report notes that North Korea is now taking significant steps to counter efforts by U.S. companies to stop the scheme. The scam operations are now subcontracting entire jobs to third-parties in South Asia or West Africa and hiring facilitators to conduct a wider array of tasks.
“In addition to remote labor, [North Koreans] hire South Asian or West African freelancers to assist with applying to jobs and with getting hired. [They] pay these freelancers to apply manually to as many open positions as possible over a given time-period, or to conduct interviews on their behalf,” the FBI advisory said.
“Increasingly, North Koreans are obtaining jobs with western companies and then hiring freelancers to complete work assignments for a fraction of the total salary. [They] subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries.”
North Korea is also targeting low-income Americans, offering freelance gigs with mundane requests like hosting laptops or interviewing on someone’s behalf. The FBI said it has seen North Korean IT workers strategize on the best locations to connect with Americans “facing financial stress.”
Those behind the scheme typically claim to be Chinese or East Asian nationals needing temporary U.S. presence or purporting to be Eastern Europeans displaced by the Russian-Ukraine war.
North Koreans are “paying Americans for an expanding range of services to hide their own involvement in the scheme, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences.”
The FBI warned that when North Koreans have been caught perpetrating the scheme, they use threats of physical violence to demand payment. Others have threatened to leak sensitive corporate data if they are not paid large lump sums.
“[North Koreans] have hired U.S.-based facilitators to appear in-person at victim companies or at the residences of laptop farm operators for intimidation,” the FBI said.
“Facilitators paid by [North Korean IT workers] have also made in-person threats against companies that removed ITW-related accounts.”
The advisory added that North Koreans are seeking to use identities that would allow them to apply for jobs that require U.S. government security clearances.
IT workers “target active-duty U.S. military members to host laptops,” the FBI said. At least one active duty member of the U.S. Army has already been convicted and sentenced for allowing his identity to be used by North Korean IT workers.
