DOJ Indicts 14 in Remote IT Worker Scheme Tied to North Korea

A federal grand jury in the Northern District of Ohio has indicted 14 individuals for running a multi-year fraud scheme that placed overseas North Korean IT workers into remote roles at more than 70 U.S. employers. The four-count indictment, returned on October 1, 2026, and announced by the Justice Department on October 13, details activity spanning from 2019 to 2025 across the healthcare, telecommunications, retail, and manufacturing sectors.

Federal prosecutors say the operation generated more than $3 million. Investigators claim that between 85% and 90% of the proceeds from such operations are diverted to North Korea's weapons of mass destruction and ballistic missile programs.

How Domestic Laptop Farms Operated

To bypass remote-hiring screening and IP-address checks, overseas operatives relied on domestic facilitators living in the United States. Employers shipped corporate laptops directly to these U.S. residences. Facilitators then wired the machines to keyboard-video-mouse (KVM) hardware and remote desktop software, allowing workers based abroad to log in while appearing to work inside the country.

"Each laptop seized potentially represents one company that has hired a DPRK IT worker," said R. Joseph Rothrock, Special Agent in Charge of the FBI Dallas Field Office.

Between September 21 and September 25, 2026, federal agents executed search warrants at more than 40 Texas homes under Operation Lonestar Roundup, seizing approximately 187 computers and KVM devices, with roughly 100 taken in North Texas alone. The Justice Department has not detailed the precise operational link between the Texas seizures and the specific defendants named in the Ohio indictment.

Indictments and Cross-Border Money Flows

Two U.S. citizens, Michael James Bostelle of Philadelphia, Pennsylvania, and Juan Cecilio Pena Carrillo of San Juan, Texas, were arrested on charges of wire fraud conspiracy, money laundering conspiracy, and identity theft conspiracy. Ten of the remaining defendants reside in China, while two identities remain under seal.

Court filings describe how facilitators funneled payroll earnings to China-based intermediaries who converted funds into cryptocurrency to skirt international sanctions. The indictment also identifies Trey Michael Nolte as an unindicted co-conspirator who allegedly ran an Ohio shell company that routed packages, received corporate laptops, and laundered funds. Prosecutors have not publicly stated why Nolte was not charged.

Federal Enforcement Targets Domestic Enablers

Cybersecurity firm CrowdStrike attributes the network to a North Korean state-aligned group known as Famous Chollima. The prosecution reflects an expanded focus by federal law enforcement to target U.S. residents who assist foreign worker rings.

The arrests fall under the Justice Department's "DPRK RevGen: Domestic Enabler Initiative," which aims to hold local hosts criminally responsible. "This investigation is about far more than fraud," said Ryan Raybould, U.S. Attorney for the Northern District of Texas. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders."