Federal prosecutors in Ohio have charged two American men, one from Philadelphia and one from Texas, with helping North Korean IT workers land remote positions at more than 70 U.S. companies. The workers allegedly used stolen or fake identities to collect paychecks that largely returned to the regime in Pyongyang.
Authorities charged 14 people in total through a Northern District of Ohio indictment that also covers ten China-based defendants who remain at large and two individuals whose names are sealed. Investigators seized about 187 laptops and keyboard-video-mouse devices, which let operators control multiple computers remotely from one location, during searches of more than 40 suspected laptop farms across Texas. The State Department is offering rewards of up to $5 million for information that leads to the disruption of the networks.
Northern District of Texas United States Attorney Ryan Raybould said in a statement:
“This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”
How It Allegedly Worked
The scheme, which ran from roughly 2019 until about July 2025 according to the Ohio indictment, involved facilitators who hosted company-issued laptops in the United States so that North Korean workers based overseas could appear to be operating from domestic addresses. In the Ohio case, Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas, were arrested. Bostelle allegedly provided his name and a fraudulent driver’s license to help a remote worker obtain employment, while Pena Carrillo is accused of hosting laptops at his home under various names and receiving about $190,000 from five employers.
An uncharged Ohio co-conspirator identified in the indictment as Trey Michael Nolte allegedly kept roughly two dozen company laptops online, installed remote-access software, and moved more than $320,000 through accounts opened in false names. Reuters reported that Nolte also recruited and trained Bostelle. The identities of more than 25 Americans were compromised in the scheme, which generated about $3 million in pay that authorities believe reached North Korean entities. More broadly, FOX 4 Dallas-Fort Worth reported that the North Korean workers allegedly send around 85% to 90% of their pay to the regime.
Texas Raids and Ongoing Investigation
In Texas, FBI agents searched more than 40 residences between September 21st and 25th as part of Operation Lonestar Roundup. More than 100 of the devices seized in the broader operation came from North Texas. No arrests have been announced from those searches.
“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said.
According to a report from CBS Texas, Raybould has indicated that indictments of the hosts are forthcoming. “It’s very hard to claim you didn’t know what you were doing when you’re hosting 30, 40, 50 laptops in your house,” he said at a press conference. Rothrock described similar laptop farm operations in Louisiana, Nevada, Kentucky, and Ohio.
Raybould cited a Treasury Department estimate that the broader IT worker scheme brought in more than $800 million for North Korea in fiscal year 2024. The investigation remains ongoing.
The actions form part of the DPRK RevGen: Domestic Enabler Initiative, a joint effort by the Justice Department’s National Security Division and the FBI’s Cyber and Counterintelligence Divisions aimed at targeting Americans who enable North Korean revenue generation schemes.
An FBI public service announcement issued the same day as the charges described how North Korean workers pay Americans to appear on camera during interviews, verify identities, ship packages, take drug tests, or keep devices online. The alert noted that facilitators are often recruited under financial stress and have faced threats of violence.
Cybersecurity firm CrowdStrike, which assisted in the disruption and tracks the activity as FAMOUS CHOLLIMA, cautioned that the operations “will likely slow” activity “only in the immediate areas” and are “unlikely to create long-lasting effects.”
Similar Cases and Crypto Thefts
Similar cases have produced convictions in recent years. An Arizona woman, Christina Chapman, was sentenced in July 2025 to 102 months in prison after she pleaded guilty to running a laptop farm that generated more than $17 million for North Korea while affecting more than 300 companies. Earlier this year, two New Jersey men were sentenced in Massachusetts to 108 and 92 months for facilitating a scheme that generated more than $5 million for North Korea, and two others from Tennessee and New York received 18 months each for related facilitation schemes.
One low-tech method companies have used to guard against nefarious job applicants associated with the North Korean regime is asking “How fat is Kim Jong Un?” during interviews, a question that CrowdStrike’s Adam Meyers said causes North Korean candidates to terminate the call immediately.
Crypto firms have been frequent targets of North Korean operations, both through earlier remote worker schemes and through direct thefts. Bitget said North Korea was “very likely” behind a $387.5 million hack last month, while blockchain analysis firms have also linked the regime to a six-month intelligence operation that preceded a $285 million theft and to last year’s $1.4 billion Bybit heist. North Korea previously declined responsibility associated with these sorts of accusations in a rare public comment on the matter.
