DoJ charges 14 and dismantles over 40 Texas laptop farms in North Korea IT worker scheme

The U.S. Department of Justice has charged 14 people and seized roughly 187 computers in its latest move against North Korea's fraudulent remote IT worker scheme, The Hacker News reports. Raids conducted between September 21 and 25, 2026 dismantled more than 40 laptop farms across Texas, and the charges were announced on October 14, 2026.

The farms were ordinary homes where employer-issued laptops sat powered on and logged in. On paper the machines belonged to American IT contractors; in practice, investigators say, North Korean operatives connected from overseas through remote-access tools, drew the salaries and sent a share back to Pyongyang. The DoJ puts the operation's run at roughly 2019 to July 2025, with workers placed inside more than 70 U.S. companies and roughly $3 million in revenue generated — money U.S. sanctions are meant to block because it funds the DPRK's weapons programmes.

Victims spanned health care, communications, cyber support, retail and manufacturing, and were located across 17 states and the District of Columbia.

How the scheme worked

Tracked as Famous Chollima, purpledelta and Wagemole, the scheme depends on U.S.-based facilitators, the DoJ alleges. They helped operatives get hired under false identities, hosted company laptops in their homes, ran remote-access software so overseas workers appeared to be domestic employees, and opened bank and money-transfer accounts to move the payroll — collecting a fee at each step.

CrowdStrike, which linked apparently unrelated employees through shared hosting addresses, documented how hardware reaches the farms: fraudulent police reports claiming a stolen laptop so a replacement ships to a farm address, rotating residential addresses to hide the destination, last-minute relocation claims to reroute devices mid-shipment, and placements through IT staffing firms that allowed client hardware to be redirected without the firm's knowledge. Since at least May 2026, CrowdStrike says, the group has also spoofed device hashes — making a video capture card register as a webcam, for example — likely to conceal its tooling.

CrowdStrike describes the farms' core function as renting out an American presence: a physical address, an identity, and enough legitimacy to pass the identity checks banks rely on.

The indictment

Brought in the Northern District of Ohio, the indictment charges a mix of U.S. citizens and Chinese nationals with wire fraud conspiracy, money laundering conspiracy and identity theft offences. Most of the Chinese defendants are listed in Dandong City or elsewhere in Liaoning province, with one in Shenzhen. Only two people are in custody: Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. The rest remain at large.

A third American, Trey Michael Nolte, is named in the indictment but not charged. Prosecutors allege he managed Dark Falls LLC, a shell company nominally offering software development services that sat between the victim companies and the scheme.

An evolving threat

The FBI separately warns that the model is expanding. According to the FBI, North Korean operatives increasingly take jobs with Western companies and then subcontract the actual work to freelancers — usually in Pakistan, sometimes elsewhere in South Asia or West Africa — for a fraction of the salary. The employer pays someone it believes is American, the regime keeps the difference, and an entirely unvetted third party gains access to code and data.

CrowdStrike expects the takedown to slow the operation only in the areas where farms were closed, and judges lasting disruption unlikely.

Why it matters

About $3 million across six years looks modest, but this is not primarily a payroll fraud story. It is a sanctioned nation-state holding credentialed insider access inside American companies — including cyber support providers — for years, by abusing the most trusted processes a business runs: hiring, onboarding and hardware logistics. Each fraudulent hire passed a recruiter, an HR team, an IT shipping desk and a finance department, and the scheme cleared every checkpoint.

Practical lessons from the CrowdStrike and FBI findings:

• Treat device logistics as a security signal. A theft report followed by a request to ship a replacement to a new address, or a relocation claim while hardware is in transit, matches the documented diversion pattern.
• Extend identity and device assurance to staffing-firm contractors, with contracts that state clearly who is accountable for it.
• Trust hardware inventories less than behaviour: spoofed hashes mean a peripheral list does not prove anyone is sitting at the keyboard.
• Verify continuously rather than only at onboarding, since a genuine identity can still front for an unvetted freelancer abroad.
• Correlate across the workforce: shared hosting addresses linking seemingly unrelated hires were exactly what exposed this network.

With most defendants out of reach, the durable control point is the employer, not law enforcement. Remote hiring grants real access, and deserves the same scrutiny as issuing a privileged credential.