US Raids Hit North Korean Laptop Farms Behind $3 Million Remote IT Worker Scheme

The US Department of Justice has disrupted multiple laptop farms across Texas that were allegedly used by North Korean nationals to run an IT worker scheme. Raids carried out from September 21 to 25 targeted more than 40 residences, and law enforcement seized 187 laptops and other devices. The DOJ said such schemes have earned millions of dollars over the last eight years by tricking US companies into hiring remote workers using stolen or purchased identities.

Alongside the raids, the DOJ indicted and arrested two US nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, on wire fraud, money laundering and identity theft charges. Prosecutors say they helped a group of North Koreans earn more than $3 million from about 70 US companies across 17 states, including healthcare, cybersecurity, retail and manufacturing organisations. They allegedly hosted laptops from 2019 to 2026 and helped workers use fake identification documents to get jobs or verify bank accounts. Several Chinese and North Korean nationals were also indicted. The DOJ did not say whether the arrests were linked to the Texas raids.

Much of the indictment centres on US national Trey Michael Nolte, who was not charged, and the DOJ did not explain why. Prosecutors say he ran a shell company that received work laptops from US companies and laundered paychecks back to North Korea. Assistant Attorney General John Eisenberg said the schemes raise money for illicit purposes, threaten employers' IT systems and data, and leave many victims of identity theft.