DOJ Charges 14 in North Korean Remote IT Worker Scheme Affecting 70 US Firms
The Justice Department announced coordinated actions against a conspiracy that used stolen identities to infiltrate US companies and generate revenue for the regime.
Key points
- Fourteen individuals face charges including wire fraud, money laundering, and identity theft.
- Two US nationals were arrested while 12 others, including ten Chinese nationals, were indicted.
- Authorities seized approximately 187 devices and searched more than 40 suspected laptop farms in Texas.
The US Department of Justice announced coordinated legal actions against a conspiracy involving North Korean remote IT workers on Tuesday. Federal authorities unsealed an indictment charging fourteen people with facilitating a scheme that infiltrated more than seventy US companies to generate illicit revenue for the Democratic People’s Republic of North Korea regime.
At a glance
- Publisher
- US Department of Justice (cybercrime)
- CVEs
- See advisory
The indictment, filed in the Northern District of Ohio, charges US nationals Michael James Bostelle and Juan Cecilio Pena Carrillo, who were arrested, along with ten Chinese nationals. Two additional defendants remain under seal. Prosecutors allege the group used stolen or fabricated identity documents and virtual private networks to make it appear as though North Korean workers were US persons operating from within the country.
Context and Background
According to the Justice Department, the scheme generated more than $3 million in revenue between 2019 and July 2025. The funds were transferred to accounts controlled by North Korean entities under US sanctions. Assistant Attorney General John A. Eisenberg stated that these schemes threaten the security of IT systems and data of deceived employers while leaving countless victims of identity theft.
U.S. Attorney Ryan Raybould for the Northern District of Texas said that dismantling laptop farms shuts down revenue streams the North Korean government relies on to fund weapons programs. Assistant Director Brett Leatherman of the FBI’s Cyber Division noted that close coordination between the private sector and federal law enforcement was central to the operation. Security firm CrowdStrike, which assisted the FBI, tracks the group as ‘Famous Chollima’.
Who Is Affected
More than seventy US companies across seventeen states and Washington, DC were affected by the remote worker infiltration. The victims operated in sectors including health, telecommunications, cyber support, retail, and manufacturing. U.S. Attorney David M. Toepfer warned that the charges serve as an urgent alert for all US companies to remain vigilant in their hiring practices.
In a separate operation called Operation Lonestar Roundup, the FBI searched more than forty homes in Texas suspected of being laptop farms in September. Agents seized approximately 187 computer devices used by DPRK IT workers. U.S. Attorney Ryan Raybould stated that the operation sends a clear message that the US will not allow enemies to exploit businesses or compromise national security.
What should you do?
The FBI has issued a Public Service Announcement with detailed mitigation guidance for US companies to combat this threat. The warning highlights that North Korean workers are increasingly hiring Americans to help them avoid detection. Some workers pass entire jobs on to other foreign nationals, complicating verification efforts for employers.
What to do and how to stay safe: North Korea
- Verify the physical location of remote IT workers using IP address validation and consistent VPN logging to ensure they are operating from declared jurisdictions.
- Conduct rigorous identity verification during hiring, including cross-referencing government-issued IDs with public records and requiring live video interviews with background checks.
- Monitor for anomalies in work patterns, such as access times inconsistent with the employee’s stated time zone or sudden changes in communication styles.
- Review third-party contractor agreements to ensure strict compliance with sanctions and identity verification requirements, as noted in the FBI’s public service announcement.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were charged in this North Korean IT worker scheme?
Fourteen individuals were charged, including two arrested US nationals, ten Chinese nationals, and two defendants whose identities remain under seal.
How much revenue did the scheme generate for the North Korean regime?
The indictment alleges the scheme generated more than $3 million in revenue from 2019 to July 2025.
What sectors were affected by the infiltration of North Korean IT workers?
Affected companies operated in health, telecommunications, cyber support, retail, and manufacturing across seventeen states and Washington, DC.
