-
The FBI searched more than 40 Texas homes and seized 187 laptops and other devices that helped North Korean workers get U.S. jobs.
-
A separate Ohio case charges 14 people. The Justice Department says their scheme hit more than 70 U.S. firms and earned about $3 million.
-
The FBI says each seized laptop may stand for one company that hired a North Korean worker under a false identity.
Federal agents have hit a scheme that puts North Korean tech workers on American payrolls. On Tuesday, Oct. 13, the Justice Department announced raids across Texas. Prosecutors also unsealed an indictment in Ohio.
The FBI searched the Texas homes between Sept. 21 and Sept. 25, then seized 187 devices. About 100 came from North Texas. The FBI calls the effort Operation Lonestar Roundup.
Details of the Case
A laptop farm is a home full of work computers. Companies mailed these laptops to new hires they believed lived in the United States. In reality, the workers were overseas and working for North Korea.
An American helper kept the laptops online. The helper also installed software, so the overseas worker could log in from far away. So the employer saw what looked like a normal remote worker in a U.S. home.
R. Joseph Rothrock, who leads the FBI’s Dallas office, put it plainly: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.”
However, though officials seized 187 devices, they didn’t categorically say that 187 companies fell for the scheme. Still, the number could be large. Investigators found North Korean workers in jobs such as software engineer and web developer.
Suspects Face Indictment in Ohio
A grand jury in Ohio returned the indictment on Oct. 1, and prosecutors unsealed it Tuesday. It charges 14 people, but the Justice Department names only 12. Two names stay sealed.
The government recently arrested two Americans: Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. Eight other defendants are in China, and two have no known location. They remain at large.
The charges against them are quite elaborate: conspiracy to commit wire fraud, money laundering plus identity theft. According to the indictment, the scheme ran from 2019 to July 2025. During that time, the workers held jobs at more than 70 firms and earned about $3 million. Officials believe the money went to North Korean groups under U.S. sanctions.
Reuters reports that Nolte, who appears in the indictment but faces no charge, allegedly recruited and trained Bostelle and other Americans. In exchange for a cut of the money, those Americans let the scheme use their names and personal details. According to reports, Nolte allegedly kept about two dozen company laptops online and moved more than $320,000 through accounts opened under false names.
CrowdStrike, a security firm, helped the FBI. It said the wider effort affected a campaign aimed at more than 70 U.S. firms and included two arrests in Ohio. However, the Justice Department’s Texas release does not mention the Ohio case. So the exact link between the 187 devices and the 70 companies is not public yet.
How the Fraudulent Scheme Operated
CrowdStrike described how workers sent laptops where they wanted. Some filed false police reports claiming a theft, so the employer shipped a replacement to a new address. Others claimed a last-minute move.
Still others got hired through staffing firms, which let them redirect equipment without the firm’s knowledge. Court papers add that workers used stolen identities and tools that hide their location.
Officials say the pay helps fund North Korea’s nuclear and missile programs. U.S. Attorney Ryan Raybould in northern Texas said the case goes far beyond fraud. John Eisenberg, the Justice Department’s national security chief, warned that the money could help build weapons aimed at the U.S. or its allies.
Data theft is a risk too. A worker on a company laptop can reach private systems. For example, prosecutors alleged in 2025 that an overseas worker stole restricted technical data from a California defense contractor.
Cybercriminals can also exploit access to corporate networks for ransomware operations. In a separate case, a Russian hacker was jailed for selling access to U.S. networks to ransomware gangs, as reported in a TorNews story.
The FBI also issued a new alert for businesses. According to the alert, North Korean workers now hire more American helpers for more tasks, including interviews. Some even pass whole jobs to other foreign contractors. In addition, they run more, smaller laptop farms to limit the damage from any one raid.
Meanwhile, CrowdStrike expects the raids to slow activity only where farms are closed, because workers adapt. The State Department offers rewards of up to $5 million for tips that disrupt the scheme.
Signs Organizations can Watch Out for
The FBI lists several red flags. Remote desktop tools on work laptops count. So does hardware that lets one computer control another. Frequent changes to bank accounts or home addresses count too. Fake ID papers do as well. No single sign proves fraud. However, several weak signs together deserve a closer look.
U.S. Attorney David Toepfer in northern Ohio called the charges an urgent alert for companies to stay careful when they hire. The investigation continues. Still, an indictment is only a charge, and prosecutors must prove guilt beyond a reasonable doubt.
