North Korean IT Rings Infiltrated Over 70 US Companies Using Domestic Laptop Farms

Overseas operatives working on behalf of North Korea infiltrated more than 70 American companies by using stolen identities and operating covert laptop farms inside private residences, the U.S. Department of Justice announced on October 13, 2026.

A 58-page federal indictment unsealed in the Northern District of Ohio charges 14 defendants with wire fraud conspiracy, money laundering conspiracy, identity theft conspiracy, and aggravated identity theft. The remote work operation ran from 2019 to 2025 and generated approximately $3 million in revenue, according to prosecutors. The targets included employers across healthcare, telecommunications, retail, and manufacturing sectors.

Two U.S. citizens, Michael James Bostelle of Philadelphia and Juan Cecilio Pena Carrillo of San Juan, Texas, were arrested for allegedly serving as domestic facilitators. Ten indicted defendants live in China, while two remain under seal.

Physical Laptop Farms Inside Domestic Residences

The scheme relied on domestic facilitators who received corporate hardware at their homes. When U.S. employers hired what they believed to be local remote software developers, they shipped company laptops directly to domestic addresses.

Rather than performing the work, the domestic hosts connected the computers to hardware setups known as laptop farms. Using remote-access tools alongside keyboard-video-mouse (KVM) devices, facilitators let overseas workers control the systems from abroad while hiding their true location. Keystrokes and IP addresses appeared to corporate security systems as originating inside American residences.

"Each laptop seized potentially represents one company that has hired a DPRK IT worker," said R. Joseph Rothrock, Special Agent in Charge of the FBI Dallas Field Office.

Operation Lonestar Roundup in Texas

The indictment accompanied a major enforcement sweep across Texas. Between September 21 and September 25, 2026, federal agents searched more than 40 residences under a multi-agency operation called Operation Lonestar Roundup.

Law enforcement seized approximately 187 laptops and KVM switches across the state, including roughly 100 devices in North Texas alone. The searches uncovered living rooms and bedrooms outfitted with rows of laptops connected to network routers and switches.

"This investigation is about far more than fraud," said Ryan Raybould, U.S. Attorney for the Northern District of Texas. "It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability."

The Department of Justice did not state whether the evidence seized during the Texas searches directly supported the Northern District of Ohio indictment, leaving the exact operational connection between the raids and the specific arrests unconfirmed.

Laundering Payroll to Fund Weapons Programs

Cybersecurity firm CrowdStrike identified the network behind the campaign as Famous Chollima. Federal investigators stated that between 85% and 90% of earnings from such IT operations are sent directly to North Korea's ballistic missile and weapons of mass destruction programs.

Conspirators routed corporate paychecks through domestic bank accounts before moving the funds abroad. Court filings note that intermediaries in China increasingly used cryptocurrency transfers to bypass Western banking sanctions.

Prosecutors also identified an Ohio man, Trey Michael Nolte, as an uncharged co-conspirator who allegedly ran a local shell company that routed packages to China, received laptops, and laundered payroll funds. The indictment did not specify why Nolte was not indicted alongside the 14 named defendants.

"North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies," said Assistant Attorney General for National Security John A. Eisenberg.

Federal Crackdown on Domestic Facilitators

The enforcement actions were coordinated under the Justice Department's DPRK RevGen: Domestic Enabler Initiative, a targeted program focused on prosecuting U.S. residents who supply physical infrastructure to overseas operatives.

"Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation's economic strength to further and fuel their own nefarious agendas," said David M. Toepfer, U.S. Attorney for the Northern District of Ohio.