DOJ Charges 14 in Alleged North Korean Remote-Work Scheme, Seizes 187 Computers
Summary
The DOJ charged 14 people and seized about 187 computers in an alleged North Korean remote-work scheme involving stolen identities, U.S. laptop farms and more than 70 companies. The FBI also warned that the scheme is evolving.
Key points
- The DOJ said two U.S. citizens were arrested and searches were conducted at more than 40 Texas residences linked to alleged laptop farms.
- The indictment alleges the scheme used stolen or fabricated identities to obtain remote jobs at more than 70 companies from 2019 to 2025, earning about $3 million.
- Authorities allege U.S. facilitators hosted company laptops, installed remote-access software and helped workers obtain jobs using false identities.
- The FBI said helpers may pose as job applicants, keep company laptops running and use freelancers abroad to conceal who is doing the work.
- The FBI warned of tactics including threats against former managers, demands for payment backed by stolen data and attempts to intimidate companies.
- CrowdStrike said the group spoofed device identifiers and reused disguised devices across jobs; the FBI recommended layered employment checks rather than blunt filters.
- The State Department is offering rewards of up to $5 million for information that disrupts the scheme.
Article Details
- Event Type
- The U.S. Department of Justice charged 14 people in connection with an alleged North Korean remote-work scheme and seized roughly 187 computers.
- Impact
- The indictment alleges that participants used stolen or fabricated identities to hold remote jobs at more than 70 companies from 2019 through 2025 and collected about $3 million. Authorities say the scheme involved U.S. laptop farms and false employment records; CrowdStrike said the action was unlikely to have a lasting effect on the group.
People
Juan Cecilio Pena CarrilloU.S. citizen charged in the indictment; prosecutors allege he hosted laptops at his home and received about $190,000 from five employers.Michael James BostelleU.S. citizen charged in the indictment; prosecutors allege he provided his name and a fraudulent driver’s license to help a remote worker obtain a job.Ryan RaybouldU.S. attorney in the Northern District of Texas quoted in the Justice Department release.Trey Michael NolteNamed as a co-conspirator in the indictment but not charged; prosecutors allege he maintained company laptops for overseas workers and moved more than $320,000 through accounts opened under false names.
Threat Actors
313 General BureauIdentified in the article as the organization under which a North Korean hacking group operates; the group was reported to pose as prospective employers to steal sensitive data and cryptocurrency.Famous ChollinaNamed by CrowdStrike as the group the laptop-farm disruption was expected to affect only to a limited extent.
Vendors
Countries
ChinaIt alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay.IndiaSome go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job.NigeriaSome go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job.North KoreaFederal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme.PakistanSome go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job.United StatesOperation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”