Summary
- Fourteen people charged and roughly 187 computers seized in a US operation targeting North Korean IT worker infiltration of more than 70 companies.
- US-based facilitators hosted employer-issued laptops at home, installed remote-access software, and helped overseas workers assume false identities to collect approximately $3 million in wages.
- The FBI warns the scheme has adapted: North Korean operatives now pay US citizens to attend interviews and drug tests on their behalf, and subcontract the actual work to freelancers in Pakistan, India and Nigeria.
- CrowdStrike assessed the takedown will have limited lasting impact on the broader operation, known as Famous Chollima, though it signals active law enforcement visibility.
- The State Department is offering up to $5 million for information that further disrupts the scheme.
What happened
The US Department of Justice unsealed an indictment in the Northern District of Ohio on Tuesday charging 14 people connected to a long-running North Korean remote IT worker scheme. Two US citizens — Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas — were arrested alongside ten individuals located in China. Together, the group allegedly held remote jobs at more than 70 companies between 2019 and 2025, using stolen or fabricated identities to collect around $3 million in wages. The DOJ also searched more than 40 residences in Texas suspected of operating as laptop farms.
How the laptop farms worked
The mechanics were straightforward but difficult to detect. A co-conspirator named in the indictment, Ohio resident Trey Michael Nolte, allegedly kept roughly two dozen company-issued laptops running for overseas workers, installed remote-access software on the devices, and moved more than $320,000 through accounts opened under false names. Carrillo hosted laptops at his home, reportedly receiving about $190,000 from five employers. Bostelle allegedly provided his name and a fraudulent driver’s licence to help a remote worker obtain employment. Prosecutors also allege the group filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration, implicating more than 25 identity theft victims.
The scheme has adapted under pressure
An updated FBI advisory released alongside the indictment details how the operation has shifted in response to improved detection. North Korean operatives now recruit US citizens facing financial hardship to appear in video interviews, take drug tests, access accounts, and keep company laptops active at home. Some cells go further, subcontracting the technical work itself to freelancers in Pakistan, India and Nigeria, creating additional layers of obfuscation between the employer and the actual operator.
Escalating extortion and intimidation
The FBI advisory also documented more aggressive behaviour following terminations. Former managers have reportedly faced threats, demands for payment backed by stolen company data, and in some cases, paid individuals showing up in person to intimidate employers. These tactics suggest the group is willing to escalate beyond fraud when its revenue is threatened.
Technical evasion is sharpening
CrowdStrike, which assisted the investigation, reported that since May the group has spoofed device identifiers — for example, making a video capture card appear as a webcam — and reused the same disguised device across multiple jobs. The FBI noted that because these behaviours broadly resemble normal remote work patterns, no single indicator is sufficient to catch them. It called for layered verification throughout the employment lifecycle and cautioned that overly blunt screening measures risk filtering out legitimate applicants.
Law enforcement impact assessed as limited
Despite the scale of Tuesday’s action, CrowdStrike offered a measured assessment of its likely effect. The company noted the disruption would probably impact only the geolocation covered by the takedown, with limited effect on the broader Famous Chollima operation. Its assessment was that such actions do, however, demonstrate to the adversary that law enforcement and private sector partners have visibility into their infrastructure. The broader objective of the scheme — circumventing sanctions to fund North Korea’s weapons programmes — remains unchanged.
Why it matters
For CISOs, this case is a reminder that the insider threat surface now extends to the hiring pipeline itself. Adversaries are not breaking through perimeter controls — they are walking through the front door with fabricated credentials, appearing on video calls via proxy, and operating inside trusted corporate environments for months or years. The scheme targets organisations that hire remotely, which today encompasses most knowledge-work sectors. The revenue generated funds a hostile state’s weapons development, meaning security failures here carry consequences well beyond corporate IP loss. With the FBI explicitly warning that no single indicator is reliable, organisations need layered identity verification at onboarding and ongoing behavioural monitoring throughout employment, not just at the point of hire.
What to do now
- Implement layered identity verification during hiring — including government ID checks and live video identity confirmation — rather than relying on any single signal.
- Establish policies requiring company-issued devices to be used from verified locations, and monitor for remote-access software installed on endpoints without authorisation.
- Brief HR and talent acquisition teams on the updated FBI indicators, including the use of proxies in interviews, reluctance to appear on camera unscripted, and mismatches between résumé details and interview responses.
- Apply behavioural monitoring throughout the employment lifecycle, not only at onboarding, as the FBI advisory explicitly flags that these workers often behave normally for extended periods before red flags emerge.
- Report suspected cases to the FBI; the State Department is offering rewards of up to $5 million for actionable information that disrupts the scheme.
