Behind some of the remote workers American companies hired over the past six years, federal prosecutors say, was the North Korean government. The Justice Department announced on October 13 that agents searched more than 40 homes in Texas used as “laptop farms,” and that the scheme reached more than 70 U.S. companies. The FBI says 14 people have been charged.
Prosecutors say the money was the point. The workers drew pay from American employers and sent it on to accounts controlled by North Korea.
How the scheme worked, according to prosecutors
Prosecutors allege that North Korean information technology workers used stolen or invented identity documents, VPNs and proxy services to look like workers based in the United States. The Justice Department’s announcement puts the period at 2019 to about July 2025.
The company laptops were the key. U.S.-based helpers allegedly received laptops that employers sent to the fake workers, kept them running at their own homes, installed remote-access software and forwarded the earnings to accounts controlled by North Korea. Each location is a “laptop farm.” To the employer, the worker appeared to be logging in from an American home address.
Prosecutors say the workers brought in about $3 million in revenue that is believed to have gone to sanctioned North Korean entities. The department cites a May 2022 federal advisory saying individual workers can earn up to $300,000 a year and that the schemes collectively generate hundreds of millions of dollars a year for weapons programs.
The victim employers were in Ohio, 16 other states and the District of Columbia, in health care, communications, cyber support, retail and manufacturing. A company that pays a remote hire has little way to know the person on the screen is not who the paperwork says. Anyone who works in hiring, or who has been asked to take a remote job on someone else’s behalf, will want to know what the FBI says to look for.
Fourteen people are charged, two defendants remain under seal, and the release lists no court dates in the Ohio case, so the next filings will show who else is named.
Get the next update the morning it lands →
The searches, the arrests and the charges
The Texas operation, which the department calls Operation Lonestar Roundup, searched more than 40 residences from September 21 to 25. The FBI seized about 187 laptops and keyboard-video-mouse devices across the operation. FBI Cyber Division Assistant Director Brett Leatherman said 14 people were charged.
The release names 12 of them. Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, both U.S. nationals, were arrested. Ten China-based defendants are charged: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long. Two more defendants remain under seal.
An indictment in the Northern District of Ohio charges four counts: wire fraud, money laundering and identity theft. The department says the court-document details are allegations and that all defendants are presumed innocent until proven guilty beyond a reasonable doubt.
U.S. Attorney David Toepfer of the Northern District of Ohio said the charges “serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.” U.S. Attorney Ryan Raybould of the Northern District of Texas called it “a hostile foreign regime infiltrating American companies through stolen identities.” CrowdStrike, a cybersecurity firm that calls the group “Famous Chollima,” identified it and helped the FBI.
What the FBI tells employers and individuals
The FBI posted an updated public service announcement the same day. It says North Korea uses thousands of state-controlled remote IT workers, and that about 85 to 90 percent of the revenue they generate goes to the North Korean government. The bureau says the teams are increasingly relying on U.S. helpers, with more laptop farms that each hold fewer laptops, and that they have turned to stolen identities, extortion and threats.
No single warning sign is reliable, the FBI says, so employers should look for combinations. They include remote desktop tools such as AnyDesk or TeamViewer, hardware that lets another computer control a work laptop, work screen recordings stored outside the company’s control, and unusually frequent changes of bank accounts or addresses. The FBI also advises against relying only on ban lists or name filters, because they can block qualified applicants and harm identity theft victims.
The bureau’s warning to individuals matters for people who are not hiring managers. It lists fake job postings on well-known job boards, often framed as freelance work, and requests to interview for someone else or to receive and host laptops at home. The FBI says it is illegal to take payment to share login details, appear on camera for someone else, ship packages or keep work devices connected at home, and that doing so exposes participants to scrutiny from law enforcement. The PSA says the workers target people under financial stress.
Reporting a suspected remote-worker scheme
The FBI’s route is free. Contact the local FBI field office and file a complaint at ic3.gov. The PSA asks for any legitimate street address tied to the activity, especially one that received a work device, along with names, accounts, phone numbers, emails, bank accounts and IP addresses, and any screenshots, messages or documents that might identify the actor.
The announcement also lists eleven email addresses that the FBI asks employers to add to the indicators they use to detect North Korean IT worker hiring. A person who receives a threat to their life or safety should call 911, the PSA says.
The State Department offers rewards of up to $5 million for information that supports efforts to disrupt North Korea’s illicit financial activity, including cybercrime, money laundering and sanctions evasion. The Justice Department’s announcement links to the department’s earlier actions in this series, in June and November 2025 and in April and May 2026.
More Financial Reading
- 16 Steps to Stop the Scams That Took $7.7 Billion From Seniors
- 24 Ways to Stretch a $2,087 Social Security Check
- 17 Ways Retirees Are Tapping a Record $14.9 Trillion in Home Equity
This article was produced with AI assistance and reviewed by The Financial Wire’s editorial team.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
