US raids Texas laptop farms tied to North Korean IT workers, arrests two

The US Justice Department said it disrupted multiple "laptop farms" across Texas that allegedly helped North Korean nationals pose as remote IT workers at American companies, The Record reported on October 13. Two US nationals were arrested in connection with the scheme, which prosecutors say generated more than $3 million for North Korean workers.

What happened

According to The Record, the raids took place between September 21 and 25 and targeted more than 40 residences in Texas. Authorities seized 187 laptops and other devices.

Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were indicted and arrested on charges of wire fraud, money laundering and identity theft. Prosecutors allege the two were key US-based participants who hosted laptops from 2019 to 2026 and helped the IT workers obtain or use fake identification. Several Chinese and North Korean nationals were also indicted. The Justice Department did not say whether the indictments were linked to the Texas raids.

Prosecutors also named a third US national, Trey Michael Nolte, who has not been charged. They allege he ran a shell company that facilitated the scheme, recruited Bostelle, shipped packages to China, received work laptops from US companies and laundered IT workers' paychecks back to North Korea. The Record notes that the department did not explain why he was not charged.

How the scheme worked

In laptop farm schemes, people in the United States receive company-issued laptops and keep them online at their homes. This lets overseas workers who were hired under stolen or fake identities connect remotely while appearing to be based in the US. According to prosecutors, this operation helped North Korean workers earn more than $3 million from about 70 US companies in 17 states, including firms in healthcare, cybersecurity, retail and manufacturing.

John Eisenberg, Assistant Attorney General for National Security, said such schemes threaten the security of US employers' IT systems and data. Brett Leatherman, Assistant Director of the FBI, said North Korea continues to use remote IT workers with stolen identities to infiltrate American companies.

Broader context

The Record reports that nearly 30 laptop farms in 16 states were raided last year, and several Americans have since been convicted and sentenced, including an active-duty US Army soldier who allowed his identity to be used. An FBI public service announcement describes newer tactics. These include subcontracting jobs to freelancers in South Asia and West Africa, paying Americans to host laptops or appear on camera, and threatening violence or data leaks against those who refuse to pay. A recent UN report also found hundreds of North Korean IT workers operating in Laos, Cambodia and other countries.

What to do

Organizations that hire remote technical staff should strengthen identity verification during hiring, confirm where company-issued devices are being shipped and used, and watch for signs such as remote-access tools on corporate laptops or mismatches between a worker's stated location and network activity.