Verify a decision

{"actor":"system:backfill","investigation_id":"20e7aef8-8120-4a9e-af29-5722dde78598","kind":"publish","page_slug":"doj-north-korean-it-worker-laptop-farm-crackdown-october-2026","published_at":"2026-10-13T23:04:24.099Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DOJ North Korean IT Worker Laptop Farm Crackdown (October 2026)","sections":[{"content":"The indictment unsealed October 13, 2026 in the Northern District of Ohio describes a coordinated conspiracy in which North Korean IT workers, using stolen or fabricated American identities and operating through U.S.-based 'laptop farms,' obtained remote employment at more than 70 U.S. companies across 17 states and Washington D.C. Targeted sectors included healthcare, cybersecurity, retail, manufacturing, aerospace, energy, financial services, defense engineering, and government technology. The overseas workers used virtual private networks and proxy infrastructure to appear as U.S.-based employees, while physically routing their work through employer-issued laptops maintained at American residential addresses. According to the DOJ, the conspiracy ran from approximately 2019 through July 2025, during which workers collectively earned approximately $3 million. CrowdStrike has publicly attributed this network to the threat actor it tracks as 'Famous Chollima,' also known as Wagemole.","heading":"Scheme Overview","severity":"critical","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Scheme","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":2,"name":"CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":2,"name":"Nextgov/FCW — FBI disrupts North Korean 'laptop farm' used to infiltrate US companies","type":"news_article","url":"https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/"}]},{"content":"The federal grand jury returned the indictment on October 1, 2026. Two U.S. citizens were arrested: Michael James Bostelle of Pennsylvania, who is alleged to have provided fraudulent identity documents used to facilitate job placements, and Juan Cecilio Pena Carrillo of Texas, who is alleged to have hosted company-issued laptops at his residence under various aliases and received approximately $190,000 from five employers. Ten additional defendants located in China were also charged: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. Two further defendants have sealed identities. A third U.S. person, Trey Michael Nolte of Ohio, is named as a co-conspirator but was not charged in this indictment; Nolte allegedly maintained approximately two dozen company laptops online, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. All charged conduct described is alleged and has not been adjudicated.","heading":"Charged Defendants","severity":"critical","sources":[{"credibility":1,"name":"DOJ USAO Northern District of Ohio — 14 Indicted in North Korean Remote IT Worker Conspiracy","type":"regulatory","url":"https://www.justice.gov/usao-ndoh/pr/14-indicted-north-korean-remote-it-worker-conspiracy-affecting-more-70-us-companies"},{"credibility":2,"name":"CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":2,"name":"The Record — Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue","type":"news_article","url":"https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas"}]},{"content":"Between September 21 and September 25, 2026, the FBI conducted Operation Lone Star Roundup, executing searches at more than 40 residences in Texas known or suspected to operate as laptop farms. Approximately 100 of the 187 seized laptops and devices came from North Texas locations. Additional searches were conducted in Louisiana, Nevada, Kentucky, and Ohio. KVM (keyboard, video, mouse) switching devices were also seized, consistent with facilitators managing multiple employer-issued machines simultaneously. The indictment was unsealed on October 13, 2026. At a press conference that day, U.S. Attorney Ryan Raybould stated: 'It's very hard to claim you didn't know what you were doing when you're hosting 30, 40, 50 laptops in your house.' FBI Special Agent Joseph Rothrock urged U.S. employers to use E-Verify and conduct thorough due diligence on remote hires. The government also noted that some North Korean operatives filed false police reports claiming their employer-issued laptops had been stolen, as a tactic to avoid detection.","heading":"Operation Lone Star Roundup — Law Enforcement Actions","severity":"high","sources":[{"credibility":2,"name":"CBS Texas — North Texas federal officials press conference, October 13, 2026","type":"news_article","url":"https://www.cbsnews.com/texas/news/fbi-us-attorney-press-conference-10-13-2026/"},{"credibility":1,"name":"DOJ Office of Public Affairs — Justice Department Announces Coordinated Actions","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":2,"name":"Daily Signal — Operation Lone Star Round-Up Disrupts North Korean IT Network","type":"news_article","url":"https://www.dailysignal.com/2026/10/13/operation-lone-star-round-up-north-korea/"}]},{"content":"The indictment identifies cryptocurrency as one method used by scheme participants to transfer proceeds overseas. Prosecutors alleged that on July 8, 2024, a co-conspirator discussed using spreadsheets to manage transfers between bank accounts and virtual currencies before sending funds to another defendant. Court documents cited in reporting identify approximately 158,123 USDC and approximately 54,574 USDT traced to at least 14 worker payment addresses. A wallet beginning '0x81c4' was identified as containing seized stablecoins; forfeiture of approximately $212,700 in digital assets was granted by the court on September 3 (the court declined to grant the initially requested forfeiture of more than $7.74 million in digital assets, citing inadequate identification of additional assets). In the broader DPRK IT worker ecosystem, the U.S. Treasury's OFAC designated six individuals and two entities in March 2026 for facilitating IT worker schemes estimated to have generated nearly $800 million in 2024, adding 21 cryptocurrency addresses to the Specially Designated Nationals list. The October 2026 indictment does not cite those March 2026 OFAC designations as directly related, though the underlying methods are consistent.","heading":"Cryptocurrency and Financial Flows","severity":"high","sources":[{"credibility":2,"name":"crypto.news — North Korean IT fraud case cites crypto transfers in alleged $3m scheme","type":"news_article","url":"https://crypto.news/north-korean-it-fraud-case-cites-crypto-transfers-3m/"},{"credibility":2,"name":"The Block — US sanctions DPRK IT facilitators over crypto transactions in $800 million scheme (March 2026)","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-03-13-us-sanctions-dprk-facilitators-393518"},{"credibility":2,"name":"RegTech Times — OFAC lists 21 crypto wallets linked to North Korea IT worker network generating $800 million","type":"news_article","url":"https://regtechtimes.com/ofac-lists-crypto-wallets-linked-to-north-korea/"}]},{"content":"The DOJ press release states that North Korea's government uses IT worker schemes to raise revenue for illicit purposes including the development of weapons that could target the United States or its allies. The U.S. Treasury estimated the broader IT worker program generated over $800 million for the DPRK in fiscal year 2024. Officials have stated that up to 90% of wages earned through these schemes is repatriated to Pyongyang and directed toward nuclear and ballistic missile development. The Famous Chollima network that encompasses this operation has also been linked to credential theft, source code exfiltration, and installation of remote access tools at victim organizations, expanding the threat surface beyond financial fraud to potential cyber espionage. These connections are asserted by U.S. government officials and have not been independently adjudicated in the October 2026 case.","heading":"DPRK Weapons Program Connection","severity":"critical","sources":[{"credibility":1,"name":"DOJ Office of Public Affairs — Justice Department Announces Coordinated Actions","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":2,"name":"Daily Signal — Operation Lone Star Round-Up Disrupts North Korean IT Network","type":"news_article","url":"https://www.dailysignal.com/2026/10/13/operation-lone-star-round-up-north-korea/"},{"credibility":2,"name":"Fortune — North Korean operatives stole $2 billion last year — and financial firms are the next target (May 2026)","type":"news_article","url":"https://fortune.com/2026/05/14/north-korea-it-workers-stealing-billions-financial-firms-next-target-crowdstrike/"}]},{"content":"The indictment alleges that more than 25 Americans had their identities stolen or fabricated identities were constructed for them as part of the scheme. These stolen identities were used to pass employment verification checks, open bank accounts, and supply false information to multiple U.S. government agencies. More than 70 U.S. companies across 17 states received fraudulent employment applications and hired overseas North Korean operatives under these false identities. Victims span healthcare, cybersecurity, retail, manufacturing, aerospace, energy, financial services, defense engineering, and government technology sectors. The scheme's longevity — spanning approximately six years — allowed operatives extended access to sensitive corporate systems. All findings described are alleged in the indictment; no conviction has been entered in the October 2026 case as of the date of this report.","heading":"Identity Theft and Corporate Victims","severity":"high","sources":[{"credibility":2,"name":"The Record — Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue","type":"news_article","url":"https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas"},{"credibility":2,"name":"CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"}]},{"content":"The October 2026 crackdown is part of a pattern of escalating U.S. enforcement. In August 2024, a Nashville man was charged for operating a laptop farm that assisted North Korean operatives at U.S. businesses. In December 2024, the DOJ indicted 14 North Korean nationals for their roles in fraudulent remote IT worker schemes. In January 2025, five individuals were indicted in a related scheme that generated at least $866,255 from 10 U.S. companies. In June 2025, a separate U.S. government operation targeted 29 suspected laptop farms across 16 states. In July 2025, a laptop farmer in a related earlier case was sentenced to 8.5 years in prison. In March 2026, OFAC designated six individuals and two entities for facilitating IT worker schemes, adding 21 cryptocurrency addresses to the SDN list and citing nearly $800 million in 2024 revenue. In July 2026, the U.S. State Department issued a formal alert to countries and companies regarding the ongoing North Korean IT worker threat. The DOJ has framed these prosecutions under the 'DPRK RevGen: Domestic Enabler Initiative,' launched March 2024.","heading":"Prior DOJ and Government Actions on DPRK IT Worker Schemes","severity":"high","sources":[{"credibility":2,"name":"The Hacker News — DOJ Indicts 5 Individuals for $866K North Korean IT Worker Scheme Violations (January 2025)","type":"news_article","url":"https://thehackernews.com/2025/01/doj-indicts-5-individuals-for-866k.html"},{"credibility":2,"name":"TechCrunch — US government takes down major North Korean remote IT workers operation (June 2025)","type":"news_article","url":"https://techcrunch.com/2025/06/30/us-government-takes-down-major-north-korean-remote-it-workers-operation"},{"credibility":2,"name":"The Register — Laptop farmer behind $17M North Korean IT worker scam locked up for 8.5 years (July 2025)","type":"news_article","url":"https://www.theregister.com/2025/07/24/laptop_farmer_north_korean_it_scam_sentenced/"},{"credibility":1,"name":"U.S. Department of State — Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers (July 2026)","type":"regulatory","url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers"}]},{"content":"U.S. law enforcement and the State Department have issued multiple advisories urging employers to adopt enhanced due diligence for remote IT hires. Recommended measures include use of E-Verify, video verification of employee identity, scrutiny of remote access tool installation requests, attention to laptop shipping addresses that differ from stated employee locations, and monitoring for multiple accounts sharing the same payment destination. The FBI noted that operatives filed false police reports claiming stolen laptops as a means of misdirecting employers and law enforcement. Employers in the sectors identified above are advised to review current and recent remote IT hires against indicators published in government advisories.","heading":"Employer Risk and Detection Guidance","severity":"medium","sources":[{"credibility":2,"name":"CBS Texas — North Texas federal officials press conference, October 13, 2026","type":"news_article","url":"https://www.cbsnews.com/texas/news/fbi-us-attorney-press-conference-10-13-2026/"},{"credibility":1,"name":"U.S. Department of State — Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers (July 2026)","type":"regulatory","url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers"}]}],"sources_used":[{"credibility":1,"name":"DOJ Office of Public Affairs — Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Scheme","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"credibility":1,"name":"DOJ USAO Northern District of Ohio — 14 Indicted in North Korean Remote IT Worker Conspiracy Affecting More Than 70 US Companies","type":"regulatory","url":"https://www.justice.gov/usao-ndoh/pr/14-indicted-north-korean-remote-it-worker-conspiracy-affecting-more-70-us-companies"},{"credibility":1,"name":"U.S. Department of State — Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers (July 2026)","type":"regulatory","url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers"},{"credibility":2,"name":"The Record — Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue","type":"news_article","url":"https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas"},{"credibility":2,"name":"CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":2,"name":"Nextgov/FCW — FBI disrupts North Korean 'laptop farm' used to infiltrate US companies","type":"news_article","url":"https://www.nextgov.com/cybersecurity/2026/10/fbi-disrupts-north-korean-laptop-farm-used-infiltrate-us-companies/416570/"},{"credibility":2,"name":"CBS Texas — FBI/U.S. Attorney press conference coverage, October 13, 2026","type":"news_article","url":"https://www.cbsnews.com/texas/news/fbi-us-attorney-press-conference-10-13-2026/"},{"credibility":2,"name":"crypto.news — North Korean IT fraud case cites crypto transfers in alleged $3m scheme","type":"news_article","url":"https://crypto.news/north-korean-it-fraud-case-cites-crypto-transfers-3m/"},{"credibility":2,"name":"The Block — US sanctions DPRK IT facilitators over crypto transactions in $800 million scheme (March 2026)","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-03-13-us-sanctions-dprk-facilitators-393518"},{"credibility":2,"name":"RegTech Times — OFAC lists 21 crypto wallets linked to North Korea IT worker network generating $800 million","type":"news_article","url":"https://regtechtimes.com/ofac-lists-crypto-wallets-linked-to-north-korea/"},{"credibility":2,"name":"The Hacker News — DOJ Indicts 5 Individuals for $866K North Korean IT Worker Scheme Violations (January 2025)","type":"news_article","url":"https://thehackernews.com/2025/01/doj-indicts-5-individuals-for-866k.html"},{"credibility":2,"name":"TechCrunch — US government takes down major North Korean remote IT workers operation (June 2025)","type":"news_article","url":"https://techcrunch.com/2025/06/30/us-government-takes-down-major-north-korean-remote-it-workers-operation"},{"credibility":2,"name":"The Register — Laptop farmer behind $17M North Korean IT worker scam locked up for 8.5 years (July 2025)","type":"news_article","url":"https://www.theregister.com/2025/07/24/laptop_farmer_north_korean_it_scam_sentenced/"},{"credibility":2,"name":"Fortune — North Korean operatives stole $2 billion last year, financial firms are the next target (May 2026)","type":"news_article","url":"https://fortune.com/2026/05/14/north-korea-it-workers-stealing-billions-financial-firms-next-target-crowdstrike/"},{"credibility":2,"name":"Daily Signal — Operation Lone Star Round-Up Disrupts North Korean IT Network","type":"news_article","url":"https://www.dailysignal.com/2026/10/13/operation-lone-star-round-up-north-korea/"},{"credibility":2,"name":"The Defiant — DOJ Announces Two Arrests in North Korean Laptop Farm Crackdown","type":"news_article","url":"https://thedefiant.io/news/security/doj-announces-two-arrests-in-north-korean-laptop-farm-crackdown"},{"credibility":3,"name":"Wikipedia — North Korean remote worker scheme","type":"other","url":"https://en.wikipedia.org/wiki/North_Korean_remote_worker_scheme"}],"summary":"On October 13, 2026, the U.S. Department of Justice unsealed a 58-page federal indictment charging two U.S. citizens and ten China-based defendants with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft in connection with a multi-year scheme to place North Korean IT workers at more than 70 U.S. companies. The scheme, which ran from approximately 2019 through 2025, generated at least $3 million in wages for overseas North Korean operatives and allegedly funneled proceeds — in part through cryptocurrency — to the DPRK government's sanctioned weapons programs. The FBI conducted Operation Lone Star Roundup, searching more than 40 Texas residences and seizing approximately 187 laptops and associated devices.","timeline":[{"date":"2019-01-01","event":"Alleged scheme begins: North Korean IT workers start obtaining fraudulent remote employment at U.S. companies through laptop farms and stolen/fabricated identities (approximate start date per indictment).","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2024-03-01","event":"DOJ launches 'DPRK RevGen: Domestic Enabler Initiative' targeting domestic and foreign collaborators in North Korea's revenue generation network.","source":"Alston Privacy blog","source_url":"https://www.alstonprivacy.com/doj-continues-to-investigate-and-prosecute-north-korean-it-worker-fraud-scheme/"},{"date":"2024-08-01","event":"DOJ charges Nashville man for operating laptop farm assisting North Korean IT workers at U.S. businesses.","source":"DOJ / GlobalSecurity","source_url":"https://www.globalsecurity.org/wmd/library/news/dprk/2024/dprk-240808-doj01.htm"},{"date":"2024-12-11","event":"DOJ indicts 14 North Korean nationals for fraudulent remote IT worker schemes.","source":"White Collar Law Blog","source_url":"https://www.whitecollarlawblog.com/2024/12/doj-indicts-14-north-korean-nationals-in-major-fraudulent-it-worker-scheme/"},{"date":"2025-01-24","event":"DOJ indicts five individuals in a related North Korean IT worker scheme that generated at least $866,255 from 10 U.S. companies.","source":"The Hacker News","source_url":"https://thehackernews.com/2025/01/doj-indicts-5-individuals-for-866k.html"},{"date":"2025-06-30","event":"U.S. government targets 29 suspected laptop farms across 16 states in a separate coordinated takedown of North Korean remote worker operations.","source":"TechCrunch","source_url":"https://techcrunch.com/2025/06/30/us-government-takes-down-major-north-korean-remote-it-workers-operation"},{"date":"2025-07-24","event":"A laptop farmer in an earlier related North Korean IT worker case is sentenced to 8.5 years in prison.","source":"The Register","source_url":"https://www.theregister.com/2025/07/24/laptop_farmer_north_korean_it_scam_sentenced/"},{"date":"2025-07-25","event":"Alleged scheme ends, per indictment timeline (approximate end date).","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2026-03-12","event":"OFAC designates six individuals and two entities for facilitating DPRK IT worker fraud schemes generating nearly $800 million in 2024; 21 cryptocurrency addresses added to SDN list.","source":"The Block","source_url":"https://www.theblock.co/news/regulation/2026-03-13-us-sanctions-dprk-facilitators-393518"},{"date":"2026-07-01","event":"U.S. State Department issues formal alert to countries and companies regarding North Korean IT worker infiltration schemes.","source":"U.S. Department of State","source_url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers"},{"date":"2026-09-21","event":"FBI begins Operation Lone Star Roundup: searches of 40+ Texas residences suspected of operating as laptop farms, seizing approximately 187 laptops and KVM devices over four days (through September 25).","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"},{"date":"2026-10-01","event":"Federal grand jury in the Northern District of Ohio returns indictment charging Michael James Bostelle, Juan Cecilio Pena Carrillo, ten China-based defendants, and two sealed defendants.","source":"CyberScoop","source_url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"date":"2026-10-13","event":"DOJ unseals indictment; Bostelle and Carrillo are arrested; DOJ and FBI hold public press conference announcing coordinated actions.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"}]},"v":1}