US Justice Department Targets North Korean IT Worker Fraud Scheme Affecting 70 Companies
North Korean IT Workers: US authorities seize devices in a crackdown on alleged remote-work fraud.
The US Department of Justice has announced a crackdown on alleged North Korean IT worker fraud. The scheme affected more than 70 American companies. Authorities arrested two people and charged 14 individuals. They also seized approximately 187 computer devices.
Investigators allege that North Korean workers used stolen identities to obtain remote IT jobs. The scheme allegedly generated millions of dollars for entities linked to North Korea. Some of these entities are connected to its weapons programmes.
The operation included an indictment in Ohio. It also involved searches at more than 40 suspected laptop farms in Texas.
Scheme Generated About $3 Million
According to the indictment, the alleged scheme operated from 2019 until around July 2025. It generated approximately $3 million in revenue.
More than 70 US employers were affected. These companies operated in healthcare, communications, cybersecurity support, retail and manufacturing. They were based in Ohio, 16 other states and the District of Columbia.
FSB Calls for Stronger Human Oversight of Agentic AI in Financial Sector
Prosecutors allege that North Korean workers used stolen or fabricated identity documents. They also relied on virtual private networks and proxy systems. These tools helped them appear to be US-based applicants.
The workers allegedly secured remote IT positions at American companies. US-based facilitators then received and hosted company-issued laptops. They reportedly configured the devices and installed remote-access software.
The facilitators are also accused of transferring earnings to accounts controlled by North Korean entities.
The indictment names two US nationals: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both were arrested in connection with the case.
Several China-based individuals also face charges. The identities of two additional defendants remain under seal.
Texas Operation Seizes 187 Devices
The FBI carried out Operation Lonestar Roundup from September 21 to September 25. Agents searched more than 40 residences in Texas. Authorities suspected these locations of operating as laptop farms for North Korean IT workers.
The FBI seized approximately 187 laptops and keyboard, video and mouse (KVM) devices. Investigators say these devices helped workers obtain remote jobs and generate revenue for North Korea.
Cybersecurity firm CrowdStrike has identified the group and its alleged helpers as “Famous Chollima.”
Investigators also identified email accounts allegedly used in the scheme. Authorities urged employers to add these accounts to their fraud-detection systems.
FBI Warns US Companies
The FBI says North Korean IT workers are changing their methods. They increasingly recruit American facilitators to evade stronger company screening. Some also subcontract entire jobs to foreign nationals.
Officials warn that the threat goes beyond financial fraud. Workers who gain access to corporate networks may steal sensitive information. They may also extract proprietary data or engage in extortion.
Assistant Attorney General John A. Eisenberg said North Korea uses these schemes to fund illicit activities. These include weapons development.
US Attorney Ryan Raybould for the Northern District of Texas also stressed the national security risks. He said the operation aims to stop foreign actors from exploiting American businesses through stolen identities.
The FBI has issued a public service announcement about the threat. It includes guidance to help companies identify suspicious applicants and protect their networks.
US Steps Up Efforts Against North Korean Revenue Schemes
The latest actions form part of the DPRK RevGen: Domestic Enabler Initiative. The Justice Department and FBI jointly lead this effort. Its goal is to disrupt North Korea’s illicit revenue streams and target alleged US-based facilitators.
US authorities have previously warned about these schemes. Workers may use false identities, fraudulent email accounts and online payment platforms. They may also rely on proxy computers and third-party intermediaries to access company networks.
The US State Department has offered rewards of up to $5 million. The rewards support efforts to disrupt North Korea’s illicit financial activities. These include cybercrime, money laundering and sanctions evasion.
The Justice Department stressed that the charges remain allegations. All defendants are presumed innocent unless proven guilty beyond a reasonable doubt in court.
