U.S. uncovers network of fake DPRK IT workers who infiltrated American companies
The U.S. Department of Justice has announced a large-scale operation against a network that helped North Korean IT specialists get remote jobs at American companies under false identities. According to the investigation, the scheme involved more than 70 employers and generated about $3 million in income, which could be used to fund the DPRK's sanctioned programs.
The results of the operation were reported by the U.S. Department of Justice on October 13.
American law enforcement charged 14 individuals, arrested two suspects, and seized approximately 187 computer devices. The main investigative actions took place in the states of Ohio and Texas.
Scheme with decoy computers
According to investigators, from 2019 to July 2025, North Korean IT workers obtained remote jobs at American companies using stolen or forged documents.
During employment, they presented themselves as U.S. citizens supposedly working on domestic territory. To conceal their actual location, they used VPNs, proxy servers, and other remote connection tools.
A key element of the scheme was so-called "laptop farms" – premises in the U.S. where employer-provided laptops for remote work were kept.
Local intermediaries received these laptops, configured remote access software, and ensured their continuous operation. This allowed specialists actually located abroad to connect to corporate systems as if they were working from the U.S.
The intermediaries also helped receive salaries and transfer earned funds to accounts linked to North Korea.
According to the Justice Department, affected employers included companies in healthcare, telecommunications, cybersecurity, retail, and industrial manufacturing. The geography of the scheme covered Ohio, 16 other American states, and the District of Columbia.
FBI conducted searches and arrested intermediaries
As part of Operation Lonestar Roundup, FBI agents from September 21 to 25 carried out investigative actions at more than 40 residences in Texas, where law enforcement suspected "laptop farms" were operating.
A total of about 187 laptops and KVM devices enabling remote computer management were seized. According to cybersecurity firm CrowdStrike, the network is linked to the group Famous Chollima.
Separately in Ohio, the arrest of two U.S. citizens – Michael James Bostella from Pennsylvania and Juan Cecilio Peña Carrillo from Texas – was announced. They are suspected of involvement in a scheme related to fraud, money laundering, and identity theft.
Among the other defendants are ten individuals believed to be in China. The identities of two more suspects have not yet been revealed.
All charges must be proven in court.
Earned funds could be directed to DPRK weapons
The U.S. Department of Justice believes that income obtained through fraudulent employment could have been transferred to organizations subject to American sanctions and controlled by the North Korean government.
American law enforcement warns that such schemes pose a threat not only through sanctions violations. Employment under false identities allows third parties to gain access to corporate networks, internal documents, and confidential information.
According to preliminary FBI data, North Korean IT specialists have used similar schemes to steal commercial information and extort money from employers.
Law enforcement also notes that participants in such networks increasingly engage American intermediaries to bypass hiring checks.
After announcing the operation's results, the FBI released additional recommendations for companies on identifying suspicious candidates for remote positions.
According to the U.S. government's assessment, illegal employment of IT specialists abroad is one way for North Korea to obtain foreign currency revenues bypassing international sanctions.
Sources: U.S. Department of Justice