North Korean IT workers infiltrated 70 US companies through laptop farms, DOJ says

The North Korean laptop farm problem is bigger than many employers assumed. The Justice Department said on Tuesday, Oct. 13, that North Korean IT workers posing as Americans got remote jobs at more than 70 US companies, with help from people inside the United States who kept company laptops running in their homes. Two US residents have been arrested, and the FBI says it searched 40 suspected laptop farms in Texas alone.

The case shows how the scheme has changed. North Korean operatives are no longer just faking résumés. According to the DOJ, they are increasingly paying Americans to be their hands and faces in the US.

What happened

According to SecurityWeek, a four count indictment charges two US residents, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, along with ten co-conspirators based in China. The Next Web reports that 14 people were charged in total, including two who have not been named, and that the charges include wire fraud, money laundering and identity theft, filed in Ohio. All defendants are presumed innocent unless proven guilty.

Prosecutors allege the scheme ran from 2019 to around July 2025 and brought in more than $3 million in fraudulent revenue. That money, per The Next Web, went to North Korean groups under US sanctions.

The affected companies were not named. TechCrunch, citing the DOJ, said they work in healthcare, cyber support, retail, communications and manufacturing, across Ohio and 16 other states plus Washington, DC.

The Texas raids

Separately, the FBI ran an operation that SecurityWeek says was called Operation Lonestar Roundup. Agents searched 40 locations in Texas suspected of operating as laptop farms and seized 187 laptops and KVM devices, the hardware that lets someone control a computer remotely. TechCrunch described it as the largest disclosed number of laptop farm homes raided so far.

How a North Korean laptop farm works

The setup is low tech but effective. A North Korean worker applies for a remote IT job using a stolen or fake American identity. Once hired, the company ships a work laptop to a US address. That address belongs to a facilitator, who plugs the laptop in, keeps it online and sets it up so the real worker can control it from abroad.

To the employer, the new hire appears to be logging in from Texas or Pennsylvania. In reality, the work is done overseas, and the paychecks are routed to accounts controlled by North Korea.

According to SecurityWeek, the operatives use VPNs and proxy services to hide their location. CrowdStrike, which helped the FBI and tracks the group as Famous Chollima, says the workers also file fraudulent police reports about stolen laptops to get replacements, claim sudden moves and rotate home addresses. Some use IT staffing firms to get in the door.

Americans for hire

The newest shift is the role of paid helpers. In a public service announcement released alongside the charges, the FBI said North Korean IT workers increasingly pay Americans to appear on camera, attend interviews, ship packages and keep devices connected from their homes. The DOJ also said some workers subcontract whole jobs to other foreign nationals.

The FBI warned that there are "thousands" of North Korean state controlled IT workers at Western companies, calling them a "significant national security and intellectual property theft insider threat."

Why it matters

This is not only about stolen wages. TechCrunch notes that these workers can steal sensitive data and intellectual property, and that some victim companies end up being extorted. The money also has a clear destination. John Eisenberg, the assistant attorney general for national security, said North Korea's regime "uses its pervasive IT worker schemes to raise revenue," according to The Next Web.

The scale goes beyond hiring fraud. TechCrunch reported that North Korea is thought to have stolen at least $2 billion in crypto in 2025, and that CrowdStrike linked North Korean hackers to about half of documented hands on keyboard intrusions over the past year. Crypto theft tied to state groups has become a steady drumbeat, as the recent Ledger CryptoBilis wallet drain shows from another angle.

Government records are a target too. The Pentagon personnel data breach exposed records of more than 3 million people, the kind of data that makes stolen identities easier to build.

Who is affected

Employers with remote roles

Any company that hires remote engineers, help desk staff or contractors is exposed. The victims in this case span ordinary sectors like retail and healthcare, not just defense or tech. CrowdStrike, per SecurityWeek, has seen victims in aerospace, energy, financial services, cybersecurity, government technology and consumer tech.

People whose identities were used

The schemes depend on real Americans' names and details. If your identity is used, you may face tax or employment record problems you never saw coming. Basic account hygiene still helps, and our guide to protecting your online accounts in 10 minutes is a quick start.

People tempted by easy side gigs

The FBI has been clear that hosting laptops for someone else is not a harmless side hustle. Offers to get paid for keeping computers plugged in at home, or for sitting in on video interviews for someone else, are red flags. Fake recruiter profiles are a common entry point, so it helps to know how to spot fake social media accounts.

What employers can do

The FBI's advice, as summarized by SecurityWeek, is to stop relying on a single check. It recommends an "identity in depth" approach, with layered access controls and detection running through the whole employment lifecycle, from interview to offboarding. The bureau says this "avoids unreliable filters" and lets several weak signals add up to a reason for a closer look.

Warning signs the FBI lists include:

1. Remote desktop or remote management software on a work laptop that does not need it.
2. External hardware, such as KVM devices, controlling the machine.
3. Downloads of apps unrelated to the job.
4. Frequent or unusual data transfers out of company systems.
5. Bank accounts and home addresses that keep changing.
6. Forged or inconsistent verification documents.

None of these proves fraud alone. Together, they are worth investigating. Simple steps, like requiring live video with cameras on during onboarding, verifying shipping addresses and watching for laptops that never move, can raise the bar.

Retailers have had a rough stretch on security already, as the Ahold Delhaize cyberattack showed. Insider threats like this one are harder to see because the attacker is technically an employee.

What to watch next

CrowdStrike told SecurityWeek it expects the disruption to have limited impact on the overall operation, which suggests more cases are coming. Watch for further indictments, more FBI searches outside Texas and possible naming of victim companies as court filings move forward. The bigger question is whether employers change remote hiring practices before the next wave.

For more coverage of security threats, visit our tech page.

Frequently asked questions

What is a North Korean laptop farm?

It is a home in the US where a facilitator keeps company laptops connected so North Korean IT workers abroad can control them remotely and appear to be working from inside the country.

How many companies were affected in this case?

The Justice Department said more than 70 US companies were infiltrated, across 17 states including Ohio, plus Washington, DC.

Who was arrested?

SecurityWeek named Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten China based co-conspirators were also charged, and all defendants are presumed innocent.

How can companies spot fake remote workers?

The FBI recommends layered identity checks and watching for combined warning signs such as remote control software, KVM hardware, unusual data transfers and constantly changing addresses or bank details.