The laptops were real, and so were the jobs. The employees, prosecutors say, were not. The U.S. Department of Justice announced on Tuesday that North Korean IT workers had infiltrated more than 70 American companies by getting hired remotely under stolen U.S. identities — and that American facilitators running “laptop farms” in Texas helped them appear to be working from inside the United States.
According to the Justice Department, federal authorities raided more than 40 laptop farms across Texas, the largest number of such locations disclosed so far, and seized more than 180 computers. The machines had been shipped out by U.S. companies to people they believed were newly hired remote employees. Prosecutors say the recipients were North Korean operatives who had used stolen identities of U.S. citizens to get the jobs, and who then accessed company systems and stole sensitive data.
How the scheme worked, according to prosecutors
The alleged arrangement depended on a physical footprint inside the United States. Facilitators received the company-issued laptops, kept them running at homes and residences in Texas, and set them up so workers overseas could connect remotely while appearing to be local staff. That matters because a laptop sitting in Texas answers many of the questions a hiring process asks — location, network address, availability during U.S. hours — without the worker ever entering the country.
The Justice Department did not name the affected companies. It described them as spanning healthcare, cyber support, retail, communications and manufacturing, located in Ohio, 16 other states and the District of Columbia, and said the infiltrations generated around $3 million.
Fourteen charged, two arrested
Federal prosecutors in Ohio unsealed a 58-page indictment that a grand jury returned on October 1, charging 14 individuals in total, according to IANS‘ reporting of the announcement. Two American nationals — Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas — were arrested. The charges include conspiracy to commit wire fraud, money laundering, and conspiracy to commit and aggravated identity theft. Prosecutors allege the scheme ran from 2019 until around July 2025. All of the conduct described in the indictment is alleged; no verdict has been returned against any of the defendants.
The scheme is adapting, the DOJ warns
The department’s warning was less about this one network than about how the method is changing. Prosecutors said North Korean workers are increasingly recruiting American facilitators to counter better detection by companies and pressure from law enforcement, assigning those facilitators a wider variety of tasks, and in some cases subcontracting entire jobs onward to third-party foreign nationals.
CrowdStrike, which helped the FBI investigate and disrupt the operation, described laptop farms as vital to North Korea’s efforts, because they solve the physical, financial and legal problems of operating against U.S. companies from outside the country. In a separate public service announcement, the FBI has said that thousands of North Korea-controlled IT workers hold jobs at Western companies and pose an insider threat to national security and intellectual property.
A revenue stream, not just a spy story
Investigators have long treated the remote-worker scheme as two crimes in one: an intelligence risk while the worker sits inside a company’s systems, and a funding channel afterwards, as wages flow back to a sanctioned regime. TechCrunch’s account of the announcement notes that workers in the scheme have also stolen information and intellectual property from inside employers and that victim companies have then been extorted. The regime is thought to have stolen at least $2 billion in cryptocurrency during 2025 alone, according to figures cited in that reporting, and CrowdStrike said earlier this year that North Korean hackers were behind around half of documented hands-on-keyboard intrusions over the past year.
For employers, the practical lesson is uncomfortable. The threat did not arrive through a firewall. It arrived through a job application, a background check built on a stolen identity, and a company laptop mailed to a farmhouse full of other companies’ laptops — a reminder that, as our coverage of account-takeover attacks on ordinary software has also shown, the weakest point in a security program is often the account, not the code.
