North Korean IT Worker Case: Texas Raids and Ohio Indictment Are Separate Actions, With No Arrests Reported From the Searches

Since the Justice Department announced on Oct. 13 that it had charged 14 people and seized about 187 devices in a North Korean remote-worker fraud case, the details show that the headline number combines two separate actions.

Two cases, one announcement

The 14 defendants come from a 58-page indictment filed in the Northern District of Ohio. Two Americans, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. Ten defendants are based in China, many in Dandong, a city on the North Korean border. Two more are under seal. The charges are wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft.

The devices come from a different operation. Under "Operation Lonestar Roundup," the FBI searched more than 40 homes in Texas known or suspected to be laptop farms between Sept. 21 and 25 and seized about 187 laptops and KVM devices, which allow a computer to be controlled remotely.

The Justice Department did not say whether anyone was arrested or charged in the Texas operation. The New York Times, as cited by Tom's Hardware, said no arrests were made there because authorities wanted to take down the operations as soon as possible and did not wait for prosecutors to file charges. The Times put the seizure at over 200 devices, above the department's figure of roughly 187.

What the indictment alleges

Prosecutors allege the scheme ran from about 2019 to July 2025 and hit more than 70 U.S. companies in health care, communications, cyber support, retail and manufacturing. Victims were in Ohio, 16 other states and Washington, D.C. The department did not name them.

The Justice Department says about $3 million in revenue went to sanctioned entities controlled by North Korea. The indictment separately alleges at least $3 million in losses and related costs to the victim companies, including legal fees and network repairs. It also alleges that more than 25 Americans' identities were compromised.

Trey Michael Nolte of Ohio is named in the indictment as a co-conspirator but has not been charged. Prosecutors allege he ran a shell company, Dark Falls LLC, that claimed to offer software development services but was used to carry out the scheme. They also allege he kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them and moved more than $320,000 through accounts opened under false names. The indictment further alleges that in February 2022 Nolte shipped two company-issued laptops and chargers to a China-based defendant, and that in 2023 he sent another defendant several packages containing MacBooks, laptops, an iPhone and other equipment obtained from American employers. An indictment is an allegation, not evidence of guilt, as the department itself notes.

Some of the alleged methods are brazen. According to the indictment, overseas co-conspirators directed the Ohio facilitator to hire an actor for an in-person job interview and to pay for ads recruiting actors with a stolen credit card. One fake employee allegedly submitted a form purportedly signed by a "psychologist" to avoid using a video camera.

FBI warning to Americans

The FBI issued a public service announcement the same day. It said North Korean IT workers pay financially strained Americans to sit for video job interviews and to complete urinalysis tests and fingerprint submissions on their behalf.

In some cases, the FBI said, workers made death threats against former managers and their families after being fired, to demand money. The bureau estimates the North Korean government receives about 85% to 90% of the revenue these workers generate.

"North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies," said Assistant Attorney General for National Security John A. Eisenberg.

Takedowns haven't stopped it

This is not the first sweep. The U.S. shut down 29 laptop farms across 16 states last year, and four U.S. citizens and a Ukrainian national were convicted in November 2025 in similar cases. Last month, U.S. and allied governments warned that a North Korean hacking group tied to the Munitions Industry Department's 313 General Bureau is posing as employers, including AI firms, to steal data and cryptocurrency from job seekers.

Adam Meyers, who leads counter adversary operations at CrowdStrike, which helped identify and disrupt the networks, says the scheme is "increasing both in prevalence and complexity." CrowdStrike identified an average of two new cases a day last month, and Meyers said that is probably only the tip of the iceberg. North Korea is reported to earn around $500 million a year from the tactic. CrowdStrike also said the laptop-farm disruption will likely yield only limited, localized impact.

The timeline also raises a practical question. The department puts the end of the charged scheme at about July 2025, more than a year before the September 2026 searches. The release does not say how many of the searched residences were still operating, or how many stopped as a result.

What comes next

The ten defendants in China remain at large, and the two sealed defendants have not been identified. Authorities warned those involved in the Texas operations that they could face criminal penalties if they continue to take part in remote-work fraud, according to Tom's Hardware's account of the Times report. No charges from the Texas searches have been announced.