On October 13, 2026, the U.S. Department of Justice announced charges, arrests, and seizures against a network that allegedly placed North Korean IT workers inside American companies using stolen identities and secret "laptop farms" in ordinary U.S. homes. Prosecutors say the operation compromised 25 American identities, placed workers at more than 70 U.S. companies, and generated at least $3 million for the overseas workers and their backers.

Two American men were arrested on charges including wire fraud, money laundering, and identity theft; ten China-based people were charged with running the overseas side; and in late September the FBI seized roughly 187 laptops and devices from more than 40 Texas residences. The case is a window into how North Korea's remote IT worker schemes function — and why U.S. authorities treat them as both a sanctions-evasion revenue stream and a national security concern.

The background: North Korea's remote IT worker playbook

Under tight international sanctions on trade, banking, and overseas labor, North Korea still needs foreign currency — and over the past decade Pyongyang has adapted by exporting something far harder to intercept at a border: skilled remote IT labor.

The playbook, as described in previous U.S. enforcement actions and the latest charges, follows a consistent pattern. North Korean IT workers apply for remote software and technology jobs at foreign companies while hiding their true identity and location. They use stolen or fabricated identities — often borrowed from real Americans — polished with fabricated work histories, and connect through virtual private networks that mask where they actually sit. To the hiring company, the new engineer looks like an ordinary remote employee living somewhere in the United States.

That is where the "laptop farm" comes in. Companies ship employer-issued laptops to a new hire's home address — here, the home of an American facilitator. According to prosecutors, facilitators received the laptops, installed remote-access software or hardware, and kept the machines running so overseas workers could control them from abroad, making every login appear to come from inside the United States.

What happened on October 13

Fourteen people were charged in total, with two defendants' cases kept under seal. The arrested Americans — Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas — face charges under a Northern District of Ohio indictment including conspiracy to commit wire and mail fraud, money laundering conspiracy, and identity theft conspiracy; Pena faces an additional aggravated identity theft count. All charges are allegations, and the defendants are presumed innocent.

Alongside the arrests, the DOJ unsealed charges against ten China-based individuals accused of directing the operation's overseas side: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. According to the indictment, those operators directed Pena and at least four other Americans participating in the scheme.

The indictment also names Ohio resident Trey Michael Nolte, who was not charged; prosecutors allege he recruited, managed, and trained Bostelle and other Americans. His alleged role shows how the schemes scale: a few coordinators recruiting a small network of facilitators can sustain dozens of illicit jobs.

The other arm was physical: in Operation Lonestar Roundup, coordinated in the Northern District of Texas, the FBI conducted searches between September 21 and 25 at more than 40 Texas residences believed to host laptop farms, seizing roughly 187 devices — laptops and keyboard-video-mouse (KVM) equipment the overseas workers used for remote control.

Prosecutors say the specific scheme ran from 2019 through July 2025 and affected more than 70 U.S. companies across 17 states and Washington, D.C. The DOJ described the fraud as "massive" and said false information connected to the scheme was sent to multiple U.S. government agencies.

Why it matters

Three features of this case explain why it has drawn so much attention from both law enforcement and corporate security teams. The first is scale. Placing workers at more than 70 companies over roughly six years, using 25 compromised American identities, is not an isolated scam — it is a sustained, industrialized operation. Each placement gave the workers legitimate access to company systems, codebases, customer data, and internal communications, which means every affected company must now investigate what the workers touched and whether anything was exfiltrated.

The second is the money: at least $3 million in revenue for the overseas workers, and at least $3 million in cleanup and legal costs for victim companies — a cost asymmetry that is the hallmark of cyber-enabled fraud.

The third is national security. A worker with legitimate access to a company's network can potentially gather intelligence, plant backdoors, or assist in later cyberattacks — and the false information that reached government agencies raises the stakes further. For policymakers, each case is evidence that remote-work hiring pipelines are now a contested front in sanctions enforcement.

The schemes also exploit a structural weakness in remote hiring: when a candidate's laptop, IP address, and mailing address all say "Texas," standard automated checks can be fooled, and the facilitator's physical American footprint is what made the deception durable.

Key facts from the DOJ announcement

  • 14 people charged in coordinated actions announced October 13, 2026; two defendants' cases remain sealed.
  • Two Americans arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, on charges of conspiracy to commit wire and mail fraud, money laundering conspiracy, and identity theft conspiracy. Pena also faces an aggravated identity theft count. Both are presumed innocent.
  • Ten China-based individuals charged with directing the operation's overseas side.
  • Operation Lonestar Roundup: FBI searches and enforcement actions September 21–25 at more than 40 Texas residences; roughly 187 laptops and remote-access devices seized.
  • Scheme timeline: prosecutors say the operation ran from 2019 to July 2025.
  • Victim footprint: more than 70 U.S. companies in 17 states plus Washington, D.C.; 25 American identities compromised.
  • Financial scale: at least $3 million in revenue for the overseas workers, and at least $3 million in remediation and legal costs for victim companies, according to the DOJ.
  • Ohio resident Trey Michael Nolte was named in the indictment but not charged; he allegedly recruited, managed, and trained American facilitators.

What happens next

The immediate next step is court proceedings for the two arrested defendants in the Northern District of Ohio, where they will enter pleas and the cases will move toward trial or resolution. Because the charges are allegations, the public record may shift as evidence is presented. The two sealed defendants and the ten China-based individuals charged remain to be located and brought to court — a reminder that enforcement against overseas operators often plays out over years.

U.S. officials say the crackdown is part of a wider, ongoing effort, and further indictments are possible. For companies, the takeaway is clear: remote-hiring pipelines need stronger identity verification — live video interviews with liveness checks, document verification, monitoring for VPNs on corporate devices, and scrutiny of mismatched shipping and payroll details.

The case also signals that "laptop farm" facilitators — Americans who may see the arrangement as easy side income — face serious federal exposure. Wire fraud, money laundering, and identity theft conspiracy charges each carry significant potential prison time. What looks like simply hosting a laptop at home can, in the government's view, be participation in a foreign sanctions-evasion scheme.

As a snapshot of how North Korea's remote IT worker operations function — and of how aggressively U.S. authorities are pursuing them — the October 13 announcement is one of the most detailed on record. For related coverage, see how the DOJ is pursuing other large-scale enforcement efforts and how cybercriminals are targeting physical infrastructure like supermarket systems. On the technology side, new warnings about self-replicating AI threats show how fast the digital attack surface is changing.