DOJ Charges Two Americans and 10 China-Based Defendants Over North Korean Laptop Farms, Seizes 187 Devices in Texas

The Justice Department announced Tuesday, Oct. 13, that it has arrested two Americans and indicted ten people based in China in a scheme to put North Korean IT workers on the payrolls of U.S. companies.

The two arrested are Michael James Bostelle of Pennsylvania and Juan Ceclilio Pena Carrillo of Texas. Both face charges of wire fraud, money laundering and identity theft. Those are allegations. Attorneys for Pena and Bostelle could not immediately be reached for comment.

What the FBI found in Texas

Between Sept. 21 and Sept. 25, the FBI searched more than 40 Texas residences suspected of operating as "laptop farms." Agents seized roughly 187 laptops and other devices, according to the DOJ. More than 100 of them came from North Texas, U.S. Attorney Ryan Raybould said at a press conference in Dallas.

FBI Dallas Special Agent in Charge Joseph Rothrock said the North Texas operation was carried out in late September, with similar operations elsewhere in Texas, plus Louisiana, Nevada, Kentucky and Ohio. Each laptop seized, he said, represents a potential victim company.

Agents also took KVM devices, which let one person control multiple computers remotely. Officials said the workers used VPNs and proxy infrastructure to appear to be logging in from inside the United States. They identified the broader group of workers and helpers as "Famous Chollima."

How the scheme worked

The model is simple. North Korean workers, using stolen or borrowed American identities, land remote jobs at U.S. firms. The employer ships a company laptop to a U.S. address. Someone there plugs it in, installs remote-access software and leaves it running, so the real worker can log in from overseas as if sitting down the street.

The DOJ says the Chinese-based operators directed Pena and Tey Michael Nolte, along with at least four other Americans. Nolte is named in the indictment but has not been charged. Prosecutors allege Nolte recruited, managed and trained Bostelle and others, who let their names and personal information be used and received a share of the proceeds. The ten China-based defendants named in the indictment are Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long.

The DOJ calls the fraud "massive." It says the scheme hit more than 70 U.S. companies, compromised the identities of 25 Americans, sent false information to multiple federal agencies and generated at least $3 million in revenue for the overseas workers.

The money

Raybould said the Treasury Department estimated this kind of activity sent more than $800 million to North Korea in fiscal year 2024, and that the cash helps fund the regime's nuclear and ballistic missile programs. Officials also said the workers send an estimated 85% to 90% of their earnings to the North Korean government.

The $3 million tied to this indictment is a small slice of that national estimate. The case describes one network among many, and the Texas seizures are one part of a multistate effort.

Officials said North Texas draws a heavy concentration of this activity because of the size of the region's employment market. They did not say where in the state the farms were located, other than that they were spread across Texas and heavily concentrated near DFW.

Hosts will not get a pass on ignorance

The obvious defense for someone who hosted a few laptops is that they did not know what they were part of. Raybould shut that down in advance.

"If you're an individual, and you have 50 laptops in your family room, you're doing something wrong," he said. He called the claim of ignorance "completely gobbledygook" and promised that people who willingly hosted the laptop farms will be indicted.

Whether any particular host knew the machines were part of a North Korean operation is a question for each case. Prosecutors will have to prove it, and defendants are presumed innocent.

What companies are being told

Raybould and Rothrock urged employers to be careful with remote hires. Their advice: use E-Verify and require multiple forms of identification for new employees. Rothrock noted that the operatives sometimes use stolen identities of unsuspecting Americans, and in other cases pay real people to lend their own.

The companies hit are the ones that hired these workers and handed over hardware and network access. Businesses or individuals who think they were affected can report to the FBI online.

The next step is further indictments. Raybould has said they are coming for the Americans who hosted laptops, and the FBI is continuing to identify additional individuals involved in the scheme. The investigation is ongoing.