The U.S. Department of Justice Announces the Indictment of 14 People, the Arrest of 2 People, and the Seizure of About 187 Devices in Connection with the North Korean Remote IT Worker Scheme

The U.S. Department of Justice announced on October 13 a coordinated action against the North Korean government's remote information technology (IT) worker scheme. The U.S. Attorney's Office for the Northern District of Ohio indicted 14 people in connection with a conspiracy that affected more than 70 U.S. companies, and among them, 2 U.S. nationals were arrested. The Federal Bureau of Investigation (FBI) searched more than 40 bases in Texas called 「laptop farms」 and seized about 187 laptops and remote access devices, the Department of Justice press release stated.

The Measures Announced by the Department of Justice

The official X account of the Department of Justice's National Security Division also announced the coordinated action on the same day, stating the indictments and arrests in Ohio and Texas and the seizure of about 187 computer devices. The FBI Cleveland Division also stated that, through its own investigation, the Northern District of Ohio prosecution indicted 14 people and 70 companies suffered damage. The number of indicted persons and victim companies is from announcements issued by the two agencies regarding the same case, and is not a value obtained by adding the numbers of different cases.

https://x.com/DOJNatSec/status/2110089489452253489 https://x.com/FBICleveland/status/2110144855032709629

According to the Department of Justice, the indictment contains four charges, namely conspiracy related to wire fraud, money laundering, and identity theft. The offence names convey the expressions in the indictment, and the Department of Justice also stated at the end of the press release that the contents of the indictment are only allegations, and that the defendants are presumed innocent until proven guilty beyond a reasonable doubt in court. 「Indicted」 does not mean 「convicted」. The names of 2 of the 14 indicted people are sealed and were not disclosed in the Department of Justice press release.

The arrested people are Michael James Bostel of Pennsylvania and Juan Cecilio Peña Carrillo of Texas, both U.S. nationals, the Northern District of Ohio prosecution stated. The remaining indicted persons included Chinese nationals stated to reside in China. This list is the composition of defendants stated by the prosecution in the indictment.

How the Scheme Operated

The method claimed by the prosecution in the indictment is as follows. North Korean IT workers used stolen or forged identity documents and virtual private network (VPN) and proxy infrastructure to appear to be Americans inside the United States, then applied for and were hired for remote IT jobs at U.S. companies. Facilitators inside the United States received and kept and set up multiple laptops issued by victim companies at their own homes, installed remote access software, and were in charge of sending the money earned to accounts controlled by North Korea, the prosecution claims.

Investigative agencies called these bases, where multiple laptops are piled up at home, 「laptop farms (laptop farm)」. The Department of Justice stated that this scheme continued from 2019 to about July 2025, that about 3 million dollars in revenue was generated from victim companies, and that the money appears to have been sent to sanctioned entities controlled by North Korea. The 3 million dollars and the remittance route are content claimed by the prosecution in the indictment and press release, and are not amounts confirmed by a court judgment. The victim industries were health, communications, cyber support, retail, and manufacturing, and companies in Ohio and 16 other states and Washington, D.C. were included, the prosecution wrote.

In Texas, a separate operation proceeded. The FBI searched, from September 21 to 25, more than 40 bases in Texas known or suspected to be laptop farms, and seized about 187 laptops and keyboard, video, and mouse (KVM) devices in the overall operation 「Lone Star Roundup」. The FBI Director's official account wrote in the weekly tally that, in connection with the North Korean scheme, 14 people were indicted, 2 people were arrested, and more than 180 devices were seized. The Department of Justice press release tally is 「about 187 devices」; the FBI Director's post tally is 「more than 180 devices」.

https://x.com/FBIDirectorKash/status/2111192508780642687

The Warning Issued to Companies

The Department of Justice stated that, on the same day, the FBI issued a public service announcement (PSA) for companies. The warning explains that North Korean IT workers, as detection by private companies has improved, are changing by recruiting U.S. facilitators more actively, expanding the work entrusted to facilitators, and, in some cases, re-entrusting the entire work to personnel in third countries. The Department of Justice press release also mentioned together existing warnings to the effect that companies should strengthen identity verification in the hiring process.

「Famous Chollima」 is the identification name CrowdStrike gave this activity, not a court-recognised name. North Korea issued no official response to this indictment.

Because laptop farms use home addresses inside the United States and U.S. facilitators, the prosecution explains this as a case involving not only overseas hacking but also identity theft inside the United States and hiring procedures. The Department of Justice wrote that this measure is part of an initiative to block North Korea's illegal revenue, and that measures of the same kind also occurred in June and November 2025 and April and May 2026.

The May 2022 joint warning mentioned by the Department of Justice explained that North Korean IT workers can earn up to 300,000 dollars per year on an individual basis. This is a general explanation in the warning and is not a value confirmed as the individual income of the defendants in this case, so it is not mixed. The press release also stated that the related information reward from the Department of State is up to 5 million dollars.

Extortion and Data Exfiltration Newly Specified in the 2025 Warning

Prior to this indictment, the Federal Bureau of Investigation had updated in stages warning text on what additional acts North Korean IT workers engage in inside companies after being hired. The public service announcement issued by the FBI on 2025-01-23 (PSA I-012325-PSA) wrote that there had been cases in which personnel whose identities were discovered held exfiltrated proprietary data and code hostage to demand a ransom, and, if the demand was not accepted, released the victim company's code. The same warning explained that they may copy company code repositories such as GitHub to personal profiles or personal cloud accounts, and may attempt to collect credentials and session cookies to open work sessions from equipment other than company devices (FBI IC3 warning, 2025-01-23). Separately from the revenue transfer claim in this indictment, the core of the federal warning is that access to the company network itself can become a channel for data leakage.