14 Charged, 187 Computers Seized in Texas ‘Laptop Farm’ Crackdown on North Korean Remote Workers: The Briefing
Federal authorities say North Korean IT workers held remote jobs at more than 70 U.S. companies using stolen identities, helped by Americans who kept company laptops running at home. Here is what was announced and what employers should check.
The Justice Department on Tuesday announced its latest move against North Korea’s remote IT worker scheme, in which workers abroad get hired by U.S. companies under false identities and send the pay back to fund the regime. This briefing is based on Greg Otto’s report for CyberScoop.
What was announced
- Charges: 14 people charged, two arrests, roughly 187 computers seized and more than 40 Texas residences searched in an effort the U.S. attorney in Texas called Operation Lonestar Roundup.
- The indictment: Unsealed in the Northern District of Ohio, it charges U.S. citizens Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, along with 10 people in China and two unnamed defendants.
- The alleged scheme: From 2019 through 2025, the group held remote jobs at more than 70 companies using stolen or made-up identities and collected about $3 million in pay.
- Laptop farms: Prosecutors say Ohio resident Trey Michael Nolte, named as a co-conspirator but not charged, kept about two dozen company laptops online for overseas workers, installed remote-access software on them and moved more than $320,000 through accounts under false names. Carrillo allegedly hosted laptops at home and received about $190,000 from five employers. Bostelle allegedly supplied his name and a fake driver’s license to help a worker get hired.
- Identity theft: False employment records were allegedly filed with DHS, the IRS and the Social Security Administration in the names of more than 25 victims.
All of these are allegations. The State Department is offering rewards of up to $5 million for information that disrupts the scheme.
How the tactics are changing
An updated FBI advisory says that as companies get better at spotting fake hires, North Korean workers now pay U.S. citizens to sit job interviews, take drug tests and keep laptops running, often targeting people under financial strain. Some outsource the actual work to freelancers in Pakistan, India and Nigeria. The advisory also describes threats against former managers after firings and demands for payment backed by stolen data. CrowdStrike says that since May the group has spoofed device identifiers, for example making a video capture card look like a webcam.
Why it matters
The FBI says no single warning sign catches these workers because their habits look like normal remote work, and it calls for layered checks throughout employment rather than blunt filters that would also screen out real applicants. CrowdStrike itself says this one takedown will likely have a limited effect. For employers, the risk goes beyond paying a fake worker: these hires have company laptops, accounts and access to data.
What this means for your company
- Verify identity at hiring, and again later. Use live video interviews with cameras on, check documents carefully and confirm references through numbers you look up yourself.
- Ship equipment to verified addresses. Be wary of last-minute address changes or requests to send a laptop to a third party.
- Watch for remote-access tools. Unapproved remote-control software on a company laptop is a red flag worth investigating.
- Review contractors and staffing agencies too. Ask how they verify the people they place with you.
Need help checking that your remote workers and their devices are who and where they say they are? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
