DOJ Unseals Indictment in North Korean Remote Work Fraud Scheme
Federal authorities have charged 14 people in connection with a long-running scheme that enabled North Korean IT workers to obtain remote employment at U.S. companies using stolen or fabricated identities. The indictment, unsealed Tuesday in the Northern District of Ohio, details how the operation functioned from 2019 through 2025, resulting in approximately $3 million in illicit pay collected by participants.
The Justice Department announced the charges alongside the seizure of roughly 187 computers and the execution of more than 40 search warrants at residences in Texas identified as "laptop farms" — locations where facilitators maintained employer-issued laptops so North Korean engineers could use them while operating overseas.
Key Defendants and Their Roles in the Scheme
The indictment names two U.S. citizens as primary defendants: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Prosecutors allege that Bostelle provided his personal information and a fraudulent driver’s license to help a North Korean worker secure employment, while Carrillo hosted company laptops at his residence under various aliases and received approximately $190,000 from five different employers.
Additionally, Trey Michael Nolte, an Ohio resident, is named as a co-conspirator for allegedly maintaining roughly two dozen company laptops online for overseas workers, installing remote-access software on them, and moving more than $320,000 through accounts opened under false names. Although Nolte is referenced in the indictment, he is not formally charged in this action. Two other unnamed defendants were also charged as part of the case.
Wider Network of Conspirators Across Multiple Countries
According to the indictment, Bostelle, Carrillo, and ten other individuals located in China participated in the scheme, holding remote jobs at more than 70 U.S. companies over the six-year period. The defendants allegedly used stolen or fabricated identities to pass background checks and gain access to corporate systems, payroll, and sensitive data.
Prosecutors further allege that the men submitted false employment records to federal agencies — including the Department of Homeland Security, the Internal Revenue Service, and the Social Security Administration — using the names of more than 25 identity theft victims to legitimize the fraudulent hires.
Evolution of Tactics Amid Increased Law Enforcement Pressure
The scheme has adapted over time in response to detection efforts. An updated FBI advisory notes that under pressure, North Korean workers now pay U.S. citizens to impersonate them during job interviews, take drug tests, access corporate accounts, and maintain laptop access from home. Recruitment frequently targets individuals experiencing financial hardship, who are viewed as more susceptible to coercion or compensation offers.
In some cases, the operation has outsourced the actual work to freelancers in Pakistan, India, and Nigeria, further obscuring the true origin of the labor and insulating the North Korean operators from direct exposure.
Escalation to Intimidation and Data Extortion
The FBI advisory also details sharper tactics employed by the network, including threats against former managers after workers are terminated, demands for payment backed by stolen corporate data, and the deployment of paid helpers to physically intimidate companies at their places of business.
Technical evasion methods have also evolved. CrowdStrike, which assisted law enforcement in the investigation, reported that since May, the group has begun spoofing device identifiers — making video capture cards appear as webcams — and reusing the same disguised hardware across multiple jobs. Because these tactics closely mimic legitimate remote work behavior, traditional security filters often fail to detect them without raising false positives against genuine applicants.
Law Enforcement Response and Ongoing Challenges
Ryan Raybould, U.S. Attorney for the Northern District of Texas, emphasized the broader implications of the operation, stating that the scheme represents more than simple fraud: "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability."
He added that "Operation Lonestar Roundup" sends a clear message: the United States will not allow adversaries to exploit American businesses or compromise national security through covert infiltration.
Despite these efforts, CrowdStrike cautioned that disrupting individual laptop farms may yield only limited, localized impact. In a blog post, the company noted that while such actions do not significantly halt the broader "Famous Chollima" campaign, they serve as an important signal: "These operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements."
Continued Threat and Government Response
The persistence of the scheme underscores its resilience. Last month, U.S. and allied governments issued warnings that a North Korean hacking group linked to the Munitions Industry Department’s 313 General Bureau is posing as prospective employers — particularly in the AI sector — to infiltrate job seekers’ networks, steal sensitive data, and extract millions in cryptocurrency. This activity aims to bypass international sanctions that restrict the regime’s access to legitimate financial channels for funding its military ambitions.
To encourage further disruption of these networks, the U.S. State Department is offering rewards of up to $5 million for information leading to the identification or dismantling of similar operations.
Source: CyberScoop