# 14 Charged in North Korean Laptop Farm Case Spanning 70+ U.S. Firms

- URL: https://usa-24.com/north-korean-laptop-farm-charges/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T23:14:17.112Z
- Updated: 2026-10-18T23:14:17.122Z
- Topics: North Korea, Remote Work Security, Insider Threats, Identity Theft, Cybercrime, Justice Department

> Prosecutors charged 14 people and seized about 187 laptops and KVM devices in a crackdown on North Korean remote IT worker schemes that reached more than 70 U.S. employers.

## Key takeaways

- An Ohio indictment charges 14 people, with 10 China-based defendants still at large and two U.S. nationals arrested.
- Investigators seized about 187 laptops and KVM devices, and searches of more than 40 Texas residences ran from September 21 to 25.
- The scheme ran from around 2019 to July 2025, touched more than 70 U.S. companies and sent roughly $3 million to North Korean-controlled entities.
- The FBI's advisory estimated that North Korea's government takes 85 to 90 percent of the revenue these remote workers generate.
- A June 2026 Skadden analysis found no enforcement action against companies that unknowingly hired these workers.

Federal agents searched more than 40 homes between September 21 and 25, mostly in North Texas, and seized about 187 laptops and keyboard, video and mouse (KVM) devices. The Justice Department and FBI announced the results on Tuesday, October 13, tying them to a North Korean laptop farm operation that touched more than 70 U.S. employers.

The Justice Department called the action coordinated pressure on North Korea's effort to fund its government through remote IT jobs at American companies. The package included an indictment, two arrests, searches of laptop farms in Texas and the seizure of about 187 devices. The [department's release](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker) lays out the core of the case.

## What the Ohio indictment charges

A 14-person indictment returned in Ohio on October 1 and unsealed on October 13 charges wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. The scheme ran from around 2019 to July 2025.

Ten defendants are China-based and remain at large. Two U.S. nationals have been arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Two more defendants are under seal, and everyone charged is presumed innocent until proven otherwise.

John A. Eisenberg, assistant attorney general for national security, said North Korea's regime “uses its pervasive IT worker schemes to raise revenue for various illicit purposes,” as [VOA reported](https://www.voanews.com/a/doj-charges-14-in-north-korean-it-worker-scheme/8211282.html). That framing treats the workers as a revenue stream for the regime, not only a fraud problem.

## How a North Korean laptop farm works

The mechanism is simple and hard to spot from the employer's side. Workers used stolen or fabricated identities and VPNs to appear to be inside the United States. U.S.-based facilitators hosted company-issued laptops in their homes, installed remote-access software and forwarded the earnings to North Korean-controlled accounts. To the employer, the person on the company laptop looked like a domestic hire.

The money flows mostly one way. The FBI's advisory estimated that North Korea's government takes 85 to 90 percent of the revenue these workers generate. Across the case, the scheme sent roughly $3 million to sanctioned North Korean-controlled entities. CrowdStrike, which helped investigators, tracks the group as Famous Chollima.

Investigators are also pulling platform records. A federal magistrate judge in Ohio issued an October 9 order directing Google to produce records for 11 accounts the investigators say the workers used. Account data like that can tie a hired name to the devices and payments behind it.

The physical side of the case is the device seizure. About 100 of the seized devices came from North Texas, according to [KRLD](https://www.audacy.com/krld/news/local/federal-agents-seize-about-100-devices-in-north-texas-north-korea-job-scheme).

## Which companies and workers face the most risk

Any company that hires remotely could be a target. Health care, communications, cyber support, retail and manufacturing stand out as sectors that could be targeted, according to [Townhall's report on the case](https://townhall.com/news/jeff-charles/2026/10/14/feds-bust-north-korean-fake-it-workers-defrauding-us-companies-n2684672).

R. Joseph Rothrock, special agent in charge of the FBI's Dallas Field Office, put the scale in plain terms in the bureau's release: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.” That line explains why the device count matters to employers beyond the courtroom.

Companies that hired these workers are treated as victims. A June 2026 analysis from [Skadden](https://www.skadden.com/insights/publications/2026/06/north-korean-remote-it) found no enforcement action filed against companies that unknowingly hired the workers. The legal exposure is narrow, but the operational exposure is not. The FBI also reported threats against former managers and their families after workers were fired, along with threats to leak corporate data unless victims paid, as summarized by [HSToday](https://www.hstoday.us/subject-matter-areas/cybersecurity/fbi-warns-north-korean-it-workers-are-expanding-recruitment-and-using-threats-of-violence/).

Individuals are exposed too. The Justice Department warned that hosting laptops for North Korean actors draws law enforcement attention, and people who host a company laptop or lend their identity may face federal charges. Identity-theft victims form another group, since the workers used stolen American identities and people whose names were misused may face records problems.

## How this case compares with earlier laptop farm prosecutions

This is not the first large laptop farm case. The table puts recent matters side by side, using figures as reported.

| Case | Scale reported |
| --- | --- |
| 2023 Arizona laptop farm | Allegedly helped workers get jobs at 309 U.S. companies |
| Arizona woman's sentencing | 102 months; more than 300 companies and over $17 million in revenue |
| January 2025 DOJ charges | Jobs at at least 64 companies |
| June 2025 DOJ searches | 29 suspected laptop farms across 16 states |
| This case (October 2026) | More than 70 U.S. companies; about $3 million to North Korean-controlled entities |

The pattern has been building for more than a year. In November 2025, five men admitted helping workers get hired by U.S. companies. In April 2026, two New Jersey men were sentenced for a scheme that generated $5 million for North Korea. The Justice Department charged five people in January 2025 over a scheme that secured jobs at at least 64 companies, as [Axios reported](https://www.axios.com/2025/01/24/north-korea-it-worker-scam-indictiments-doj).

By company count, the 2023 Arizona case alleged a bigger footprint, with 309 companies. The Texas searches reached more than 40 residences in one state, while the June 2025 action covered 29 suspected laptop farms across 16 states. The units differ, so the cleaner takeaway is the shift toward coordinated, multi-part enforcement. Ryan Raybould, U.S. attorney for the Northern District of Texas, said in a news release, “This investigation is about far more than fraud.”

A Treasury estimate cited by a local outlet puts similar schemes at up to $800 million a year. That is a broader figure, not a finding in this case, and it should be read that way.

## Steps hiring teams can take now

These steps are our own recommendations rather than government guidance, but each one targets a tactic described in the case.

- Verify remote candidates with live video or in-person checks, and compare the person on camera with a government ID during hiring and onboarding.
- Be cautious about shipping company laptops to any address that does not match the employee's verified location.
- Monitor company devices for unexpected logins, unfamiliar remote-access software and VPN activity, especially on machines that rarely leave the office.
- Report suspicious activity to the FBI's Internet Crime Complaint Center at ic3.gov, which the FBI asked for in its outreach.

## What remains unclear and what comes next

The victim companies have not been named. The device count also varies, with most reports citing about 187 and some rounding to nearly 190. The ten China-based defendants remain at large, and the sources reviewed for this story did not yet describe court appearances for the two arrested Americans. It is also unclear how many hires were made through facilitators and how many companies were harmed without knowing it.

The Ohio docket will show whether the sealed defendants surface and how the Google records are used. Bringing the China-based defendants into a U.S. courtroom is far harder, and it will depend on cooperation from other governments. Enforcement pressure is also spreading to other fraud tools, as shown by [Microsoft's takedown of the YAM Store, CoGUI and Iron Man phishing kits](https://usa-24.com/yam-store-phishing-takedown-2/). The next clear signal will come from whether employers start reporting more suspicious hires to the FBI.

## Frequently asked questions

### Is hosting a laptop for a remote employer illegal?

It can be, depending on who is behind the work. The Justice Department warned that hosting laptops for North Korean actors draws law enforcement attention, and people who host company laptops or lend their identities may face federal charges. Anyone asked to receive and forward company equipment should verify the employer independently before agreeing.

### How many companies were affected by the North Korean laptop farm scheme?

More than 70 U.S. companies were affected, and the scheme sent roughly $3 million to sanctioned North Korean-controlled entities. Investigators seized about 187 laptops and KVM devices, although some outlets round the figure to nearly 190.

### Were the companies that hired these workers charged?

No enforcement action has been filed against companies that unknowingly hired these workers, according to a June 2026 Skadden analysis. Companies are treated as victims in these cases. Investigators have not named the victim companies.

### How can I report a suspected North Korean IT worker?

Report suspicious activity to the FBI's Internet Crime Complaint Center at ic3.gov. Before onboarding, verify remote candidates with live video or in-person checks, and watch for unexpected logins on company devices.

### What is Famous Chollima?

Famous Chollima is the name CrowdStrike uses to track the North Korean group tied to these remote IT worker schemes. CrowdStrike helped investigators in this case. The workers used stolen or fabricated identities and VPNs to appear to be inside the United States.

## Sources

1. [Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker)
2. [Arizona Woman Sentenced for $17M Information Technology Worker Fraud Scheme](https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue)
3. [DOJ charges 14 in North Korean IT worker scheme](https://www.voanews.com/a/doj-charges-14-in-north-korean-it-worker-scheme/8211282.html)
4. [FBI: Texas 'Laptop Farms' Turned American Paychecks Into Cash For North Korea's Nukes](https://www.yahoo.com/news/us/articles/fbi-texas-laptop-farms-turned-160046929.html)
5. [FBI Raids Over 40 Texas Homes, Charges Americans in North Korean 'Laptop Farm' Scheme](https://gizmodo.com/fbi-raids-over-40-texas-homes-charges-americans-in-north-korean-laptop-farm-scheme-2000825918)
6. [Federal agents seize about 100 devices in North Texas North Korea job scheme](https://www.audacy.com/krld/news/local/federal-agents-seize-about-100-devices-in-north-texas-north-korea-job-scheme)
7. [FBI Warns North Korean IT Workers Are Expanding Recruitment and Using Threats of Violence](https://www.hstoday.us/subject-matter-areas/cybersecurity/fbi-warns-north-korean-it-workers-are-expanding-recruitment-and-using-threats-of-violence/)
8. [North Korean Remote IT Worker Fraud: Managing Insider Threat, Sanctions and Employment Risk](https://www.skadden.com/insights/publications/2026/06/north-korean-remote-it)
9. [The Justice Department indicts two Americans in North Korean IT worker fraud](https://www.axios.com/2025/01/24/north-korea-it-worker-scam-indictiments-doj)
10. [Feds Bust North Korean Fake IT Workers Defrauding US Companies](https://townhall.com/news/jeff-charles/2026/10/14/feds-bust-north-korean-fake-it-workers-defrauding-us-companies-n2684672)
11. [U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud](https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html)