Texas Raid Uncovers North Korean Laptop Farm That Defrauded 70 Companies of $3M
DoJ arrests two nationals in Texas raid targeting remote worker scams that used stolen identities to defraud employers.
Key points
- Department of Justice raided 40 Texas residences, seizing 187 laptops used by North Korean IT workers.
- Two US nationals were arrested for facilitating wire fraud, money laundering and identity theft.
- The scheme generated over $3 million from roughly 70 US companies across multiple sectors.
Organisations in healthcare, retail, manufacturing and cybersecurity are facing significant exposure after a federal operation disrupted North Korean IT worker schemes. The Department of Justice confirmed that these fraudulent operations used stolen or purchased identities to trick US companies into hiring remote workers. This incident highlights the ongoing risk to organisations that hire remote staff without rigorous verification processes.
Which organisations and data were involved?
Prosecutors stated that the scheme generated more than $3 million from approximately 70 US companies operating across 17 states. Victims included organisations in healthcare, cybersecurity, retail and manufacturing sectors. The fraud relied on stolen or purchased identities, meaning affected firms likely granted remote access to individuals using fake credentials. The Department of Justice warned that these schemes threaten the security of the IT systems and data of the deceived US employers.
Who was arrested and what were the charges?
The Department of Justice arrested two US nationals: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. They face charges of wire fraud, money laundering and identity theft. Prosecutors accused them of helping North Korean nationals obtain remote IT roles by providing fake identification documents and hosting laptops. Several Chinese and North Korean nationals were also indicted for their roles in the multi-year conspiracy.
How did the laptop farm scheme operate?
From 2019 to July 2025, facilitators housed and configured company-issued laptops in Texas residences to make workers appear to be in the US. According to CrowdStrike, operatives used deceptive tactics such as filing false police reports for stolen devices or claiming sudden relocation to divert shipments. They employed VPNs and proxy infrastructure to mask their true locations. This allowed North Korean IT workers to bypass geographic restrictions and obtain employment at US companies.
What does this mean for corporate security?
The Department of Justice warned that these schemes threaten the security of IT systems and data of deceived employers. Assistant Attorney General John Eisenberg noted that the revenue funds illicit purposes, including weapons development. For organisations, this means that remote workforce verification is a critical control point. The use of shell companies and staffing firms further obscured the true identity of the workers, complicating detection efforts for HR and security teams.
What affected people can do
Individuals whose identities may have been used in such schemes should monitor credit reports and bank statements for unauthorised activity. Check whether any employment applications or tax filings were submitted in your name. If you suspect identity theft, place a fraud alert or credit freeze with major bureaus. Be vigilant for follow-up scams that reference this incident to extract further personal details or financial data. Verify the legitimacy of any unsolicited communications regarding employment or device recovery.
What to do and how to stay safe: North Korea
- Verify the employment status of all remote workers through independent background checks and video interviews before issuing devices.
- Monitor network logs for anomalous geolocation data or simultaneous logins from disparate regions that suggest device sharing.
- Audit hardware inventory to ensure all issued laptops are physically accounted for and not redirected to unknown residential addresses.
- Review identity verification procedures for new hires to detect synthetic identities or forged documentation early in the onboarding process.
Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much revenue did the laptop farm scheme generate?
Prosecutors stated the scheme generated more than $3 million from US companies over the last eight years.
How many laptops were seized in the Texas raids?
Law enforcement seized 187 laptops and other devices during the operation targeting 40 residences.
Which sectors were affected by the identity fraud?
Affected sectors included healthcare, cybersecurity, retail, manufacturing, communications and cyber support.
