Federal prosecutors have charged 14 people in a scheme that allegedly placed North Korean IT workers in remote jobs at more than 70 U.S. companies, and FBI agents seized about 187 laptops and related devices from suspected "laptop farms" in Texas, the Justice Department announced Tuesday. For employers, the case and an accompanying FBI warning point to the same lesson: a remote hire's identity has to be checked continuously, not only at the job offer.

What Happened

A four-count indictment in the Northern District of Ohio charges wire fraud, money laundering and identity theft, according to the Justice Department release. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. Ten China-based defendants are named, and two more remain under seal.

Prosecutors allege that from 2019 to about July 2025 the scheme placed workers at more than 70 employers in health care, communications, cyber support, retail and manufacturing, in Ohio, 16 other states and Washington, D.C. It generated about $3 million that investigators believe went to sanctioned entities controlled by North Korea. CyberScoop, reading the indictment, reported that the defendants allegedly filed false employment records in the names of more than 25 identity theft victims. The charges are allegations, and the department notes that all defendants are presumed innocent until proven guilty.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Separately, in what the department calls Operation Lonestar Roundup, agents carried out searches and other actions at more than 40 Texas residences known or suspected to be laptop farms between Sept. 21 and 25. A laptop farm is a home where a U.S.-based helper keeps company-issued computers running so workers abroad can log in and appear to be in the country. The haul included laptops and KVM devices, hardware that lets one person control a computer's keyboard, video and mouse from elsewhere.

The department credited security company CrowdStrike, which tracks the group as Famous Chollima, with supplying information. The release also lists 11 Gmail addresses it ties to the schemes and asks employers to add them to their detection lists.

Why It Matters

The hiring pipeline has become a security perimeter. A worker who passes a video interview and a background check can still be a front for someone else, and once inside can reach source code, customer data and internal systems. The department says some of these workers have stolen proprietary data and extorted employers. Paying such a worker can also send money to a sanctioned government: the FBI's public service announcement says Pyongyang receives an estimated 85% to 90% of the revenue the workers generate, which funds its nuclear and military programs.

The FBI advisory, "North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment," says the operation is adapting. Workers increasingly pay Americans to host laptops, sit interviews or lend long-established professional networking accounts. They run more laptop farms with fewer machines each, to avoid a single point of failure, and subcontract work to freelancers, usually in Pakistan, India or Nigeria. The FBI says they are seeking jobs that require security clearances, including at cleared defense contractors, are recruiting active-duty service members to host laptops, and have made death threats against former managers after being fired.

For hiring and security teams, the FBI lists warning signs that matter most in combination: remote-desktop tools such as AnyDesk, TeamViewer or RustDesk on work devices; KVM-over-IP hardware such as TinyPilot or PiKVM; job-unrelated software such as OBS Studio; and unusually frequent changes of bank account or address. It recommends what it calls "identity in depth," layered checks across the employment lifecycle shared among HR, IT and security, plus live identity verification. It cautions that ban lists and name filters are unreliable and can harm identity theft victims.

What to Watch

David M. Toepfer, the U.S. attorney for the Northern District of Ohio, said the charges "serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices." The action is part of a Justice Department and FBI effort that announced earlier rounds in June and November 2025 and April and May 2026, and CyberScoop reported that CrowdStrike expects the takedown to have limited lasting effect on the group. Watch for further unsealed charges from the Texas searches and for companies disclosing that they unknowingly employed these workers. The FBI asks employers to report suspicious addresses and identifiers through ic3.gov, and the State Department offers rewards of up to $5 million for information on North Korean illicit finance.