The US Justice Department said on 13 October 2026 that it has charged 14 people over an alleged scheme in which North Korean IT workers posed as Americans to get remote jobs at US companies, sending the money back to the North Korean government [1]. Two US citizens have been arrested, and the FBI has seized about 187 laptops and other devices in raids across Texas.
These are charges, not convictions. The Justice Department said: “The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.” [1]
What is a “laptop farm”?
When a US company hires a remote worker, it usually posts a work laptop to the worker’s home address. In these schemes, according to the Justice Department, the “worker” is really a North Korean IT specialist abroad using a stolen or fake American identity [1].
So the laptop is sent to a helper in the United States instead. That helper keeps the laptops at home, often many of them for different employers, plugs them in, and installs remote-access software so the workers overseas can log in and control them. To the employer, it looks as though their new hire is working from a normal US address on a US internet connection. A house full of these company laptops is what investigators call a “laptop farm”.
The Justice Department said the helpers in this case “received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences”, “installed remote-access software and transferred earnings to DPRK‑controlled accounts” [1]. DPRK is short for the Democratic People’s Republic of Korea, North Korea’s official name.
The Ohio case: 14 charged
Prosecutors in the Northern District of Ohio announced the arrests of Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, both US nationals, on “a four-count wire fraud, money laundering, and identity theft indictment” [1].
The same indictment charges ten people the department described as China-based: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long. The Justice Department said “the identities of two additional defendants remain under seal” [1].
According to the indictment, the scheme ran “from 2019 to in or around July 2025”. The workers allegedly used “stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States” [1].
The Justice Department said the scheme “impacted more than 70 U.S. company employers” and generated about $3 million in revenue, which “is believed to have been sent to sanctioned entities controlled by the DPRK” [1]. The employers included companies in “health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia” [1].
Operation Lonestar Roundup in Texas
Separately, the Justice Department said that “between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas” known or suspected to be laptop farms for North Korean IT workers [1]. Across the whole operation, called Operation Lonestar Roundup, the FBI seized “approximately 187 laptops and KVM (keyboard, video, mouse) devices” [1]. A KVM device lets one person control several computers from a single keyboard, screen and mouse.
The department said US cybersecurity firm CrowdStrike has identified this group of North Korean IT workers and their helpers as “Famous Chollima” [1].
What officials said
John A. Eisenberg, Assistant Attorney General for National Security, said: “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies.” [1]
Ryan Raybould, US Attorney for the Northern District of Texas, said: “Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.” [1]
Brett Leatherman, Assistant Director of the FBI’s Cyber Division, said the actions involved “securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected ‘laptop farms’ across Texas.” [1]
David M. Toepfer, US Attorney for the Northern District of Ohio, said: “These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.” [1]
Advice for employers
The FBI published a new public service announcement the same day with guidance for companies [2]. According to the Justice Department, North Korean IT workers are “increasingly” recruiting American helpers to get around better detection, and in some cases are “subcontracting entire jobs to third-party foreign nationals” [1]. The release also lists email addresses that investigators say were used in the scheme, so employers can check for them [1].
What this means
- These are allegations. Nobody has been convicted in this case, and all defendants are presumed innocent.
- Remote hiring is the weak point. The alleged scheme depended on companies never meeting new hires in person and shipping laptops to addresses they could not check.
- The helpers are in the US. Officials are focusing on the Americans who allegedly host the laptops, not only the workers abroad.
Related stories
- Meta, 14 Other Tech Companies and Law Enforcement Disrupt Scam Networks in West Africa
- Meta Says Hackers Used an Employee’s Stolen Login to Get Into Its GitHub Code, and Is Notifying About 1,500 People
Sources
- US Department of Justice, Office of Public Affairs, “Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies”, 13 October 2026. https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker
- FBI Internet Crime Complaint Center, Public Service Announcement PSA261013, 13 October 2026. https://www.ic3.gov/PSA/2026/PSA261013
