U.S. charges 14 and raids 40 laptop farms in North Korean IT worker crackdown
The U.S. Justice Department announced Oct. 13 that agents searched more than 40 suspected laptop farms in Texas and that 14 people have been charged in a scheme that placed North Korean IT workers in remote jobs at more than 70 U.S. companies.
North Korea uses remote IT workers with stolen or fake identities to earn money for the regime. Laptop farms, where U.S.-based helpers host company-issued computers, make the workers appear to be in the United States.
What happened
According to the Justice Department, Operation Lonestar Roundup was led by the U.S. Attorney's Office for the Northern District of Texas, the FBI's Dallas field office and the FBI Cyber Division. Agents searched more than 40 residences between Sept. 21 and 25 and seized about 187 laptops and KVM (keyboard, video, mouse) switches used to control the machines remotely.
In a related indictment from the Northern District of Ohio, 14 people were charged, including 10 China-based defendants; two more defendants' identities remain sealed. Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. Prosecutors say the scheme generated about $3 million (U.S.) for North Korean IT workers and affected employers in Ohio, 16 other states and Washington, D.C.
The Hacker News reported that the charges include wire fraud conspiracy, money laundering conspiracy and identity theft offences, and that the scheme ran from about 2019 to July 2025. It said facilitators hosted laptops, opened U.S. bank and money transfer accounts and were paid fees. One alleged shell company, Dark Falls LLC, claimed to offer software development services.
Changing tactics
CrowdStrike, which assisted, reported that the workers filed false police reports about stolen laptops and diverted shipments to farm addresses, and since at least May 2026 have spoofed device identifiers, such as disguising a video capture card as a webcam. The FBI said in a related alert that the workers have subcontracted to freelancers in other countries, threatened former managers and tried to recruit cleared defence contractors and U.S. military members to host laptops, The Hacker News reported.
Why it matters in Canada
The Justice Department did not mention Canadian victims. But the scheme targets any employer that hires remote technical staff, and Canadian companies use the same hiring platforms and remote-work setups.
What to do
- Verify the identity of remote hires with live video and in-person or notarized document checks.
- Ship equipment only to verified home addresses, and investigate requests to change delivery addresses.
- Watch for remote-access tools, KVM-over-IP devices and logins from unexpected locations on company laptops.
- Confirm payroll accounts belong to the employee being paid.
