14 Charged in North Korean IT Worker Scheme That Hit 70-Plus U.S. Companies. Two Americans Ran 'Laptop Farms,' DOJ Says.
Federal prosecutors in Cleveland have unsealed a 58-page indictment charging 14 people, two of them U.S. citizens, with running a scheme that placed North Korean operatives in remote information-technology jobs at more than 70 American companies and generated about $3 million believed to have flowed to entities controlled by the North Korean government. The Justice Department announced the case on Oct. 13 alongside FBI searches of more than 40 suspected "laptop farms" in Texas. The Digital Free Press has asked the U.S. Attorney's Office for the Northern District of Ohio for comment and will update this story with any response.
A federal grand jury returned the indictment on Oct. 1, 2026, charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft, the U.S. Attorney's Office said. Twelve defendants are named: Michael James Bostelle, 31, of Philadelphia; Juan Cecilio Pena Carrillo, 37, of San Juan, Texas; and 10 China-based defendants, most of them in Dandong, a Chinese city on the North Korean border: Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long. Two more defendants remain under seal. All are presumed innocent unless proven guilty.
HOW THE NORTH KOREAN IT WORKER SCHEME WORKED
According to the indictment, from 2019 until about July 2025, North Korean IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure "to appear as though they were U.S. persons working from within the United States." U.S.-based facilitators received laptops that the victim companies had issued to their new "employees," hosted the machines at their homes, installed remote-access software so the workers abroad could use them, and transferred earnings to accounts controlled by North Korea, the Justice Department said.
Victim employers included companies in health care, communications, cyber support, retail and manufacturing in Ohio, 16 other states and the District of Columbia, including Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania and Washington. The releases do not name any of the companies.
"Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation's economic strength to further and fuel their own nefarious agendas," said U.S. Attorney David M. Toepfer. Assistant Attorney General for National Security John A. Eisenberg said the regime uses the schemes "to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies."
THE TWO AMERICANS
Court records show both American defendants were arrested before the case was unsealed. Pena Carrillo was arrested in McAllen, Texas, on Oct. 7, and Bostelle was arrested in Philadelphia on Oct. 9, according to arrest warrant returns filed in the case. The U.S. Attorney's Office said both are expected to make their initial appearances in federal court in the Northern District of Ohio "in the near future." The 10 China-based defendants remain at large.
OPERATION LONESTAR ROUNDUP
Between Sept. 21 and Sept. 25, the FBI searched more than 40 residences in Texas known or suspected to be operating as laptop farms and seized about 187 laptops and keyboard-video-mouse devices, the Justice Department said. The cybersecurity firm CrowdStrike tracks this group of North Korean IT workers and their helpers as "Famous Chollima," according to the department, which also published 11 Gmail addresses it says the operatives used and urged employers to add them to their screening lists.
"Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability," said U.S. Attorney Ryan Raybould for the Northern District of Texas.
The FBI issued a public service announcement the same day warning that North Korean IT workers are increasingly recruiting American facilitators to get around better corporate screening, hiring them for a wider range of tasks and in some cases subcontracting entire jobs to third-party foreign nationals.
WHAT TDFP ASKED
On Oct. 14, TDFP emailed the U.S. Attorney's Office for the Northern District of Ohio, with a deadline of 3 p.m. Eastern on Thursday, Oct. 15:
1. Are any of the victim companies federal contractors or subcontractors, or did any workers reach government systems?
2. Did the workers access sensitive data or source code at any victim company?
3. Of the roughly $3 million in revenue, how much has been seized or frozen?
4. Are Michael Bostelle and Juan Pena Carrillo in custody, when are their initial appearances, and who represents them?
TDFP has asked the office for comment and will update this story with any response.
Assistant U.S. Attorney Duncan T. Brown and Trial Attorney Neeraj Gupta of the National Security Division are prosecuting the case, which the FBI's Cleveland field office investigated.
Hold Everyone Accountable.
Sources: U.S. Attorney's Office for the Northern District of Ohio press release (Oct. 13, 2026); Justice Department Office of Public Affairs press release (Oct. 13, 2026); court docket, United States v. Ming, No. 1:26-cr-00429 (N.D. Ohio) via CourtListener; FBI public service announcement PSA261013 (Oct. 13, 2026).
Images: Cover photo of the Carl B. Stokes U.S. Courthouse in Cleveland by Warren LeMay, CC0, via Wikimedia Commons; FBI seal, public domain.
Comments