U.S. Charges 14 and Dismantles North Korean Laptop Farms

The U.S. Department of Justice has charged 14 people and seized about 187 computers in an investigation into a North Korean fraudulent remote IT-worker scheme. Raids conducted in Texas between September 21 and 25, 2026 also dismantled more than 40 laptop farms that authorities say helped overseas workers appear to be U.S.-based employees.

The indictment alleges that a mix of U.S. citizens and Chinese nationals participated in a conspiracy that affected more than 70 U.S. companies. The defendants face charges including wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. Two U.S. nationals, Juan Cecilio Pena Carrillo and Michael James Bostelle, were arrested; the remaining charged defendants are at large.

A multiyear route into remote employment

Authorities say the scheme operated from about 2019 to July 2025 and generated approximately $3 million for IT workers. It was designed to obtain remote IT jobs at U.S. and other companies under false identities, with part of the resulting salary allegedly sent to the Democratic People's Republic of Korea in violation of international sanctions.

Victim organisations operated in health care, communications, cyber support, retail and manufacturing, the Justice Department said. They were located in Ohio and across much of the United States, including California, Massachusetts, New York, Texas, Washington and the District of Columbia.

The operation is known as Famous Chollima, purpledelta and Wagemole. Court documents allege that U.S.-based facilitators helped workers secure jobs, hosted employer-issued laptops at their residences, and used remote-access technology to make overseas personnel look like legitimate domestic staff. Facilitators also allegedly created U.S. bank and online money-transfer accounts to move payments abroad in return for fees.

Laptop farms provided a domestic footprint

CrowdStrike described laptop farms and their facilitators as a rented U.S. footprint that could provide a physical address, legal identity and a way to meet know-your-client checks. The company said its investigation linked apparently unrelated employees with laptop-hosting locations and identified methods used to redirect employer hardware during onboarding.

Those methods included fraudulent police reports claiming a laptop had been stolen, prompting replacement devices to be delivered to farm addresses. Other operatives allegedly cited last-minute relocations to divert shipments, or obtained positions through IT staffing firms so that end-client equipment could be redirected without the staffing firm's knowledge.

Since at least May 2026, CrowdStrike said Famous Chollima had also begun spoofing device hashes, including making a video capture card appear to be a webcam. The company assessed that closing the farms would likely slow activity in the immediately affected areas but would not create lasting disruption because the actors are expected to adapt.

FBI warns of broader facilitator activity

The FBI said the operation has expanded its use of facilitators and, in some cases, subcontracted whole jobs to freelancers in South Asia or West Africa. North Korean workers have allegedly hired freelancers in countries including Pakistan, India and Nigeria to submit applications, undertake interviews or complete assigned work for a fraction of the salary.

The bureau also reported that the actors may use facilitator identities without permission to seek more jobs than agreed, target economically vulnerable Americans for facilitator roles, and invent companies and documents to support fabricated personal histories. The FBI identified cases involving threats of physical violence against former managers and their families to demand payments or compel actions that support the scheme.

For employers, the case makes remote-work controls a practical hiring and security requirement: verify identity claims, delivery locations and device use; monitor payment and access irregularities; and ensure that staffing partners can detect unauthorised equipment redirection before a remote hire receives sensitive access.