U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

A North Korean remote IT worker scheme places overseas workers in jobs by using false identities and misleading employers about their location. The workers receive regular salaries, and part of that money is allegedly sent to North Korea. The scheme matters because it can evade sanctions and support the DPRK government’s military programs.

Laptop farms are U.S. residences where facilitators host company-issued computers. Overseas workers connect remotely, making their activity appear to come from a U.S. address. Facilitators also help workers get hired and manage accounts used to move their earnings. The operation affected more than 70 U.S. companies.

The article describes related tactics, including rotating residential addresses and redirecting employer laptops during onboarding. Some operatives allegedly filed false police reports to obtain replacement devices. Since at least May 2026, Famous Chollima reportedly spoofed device hashes, including mimicking a video capture card as a webcam.

The Department of Justice charged 14 people in an alleged North Korean remote IT worker conspiracy. Investigators seized about 187 computers and KVM devices as part of efforts to disrupt the operation. The charges include wire fraud conspiracy, money laundering conspiracy to commit identity theft, and aggravated identity theft.

The indictment names U.S. citizens and Chinese nationals. Michael James Bostelle, of Philadelphia, and Juan Cecilio Pena Carrillo, of San Juan, Texas, were arrested. The article says the remaining charged individuals remained at large. Trey Michael Nolte was also named as a key U.S.-based co-conspirator but was not charged.

Nolte allegedly managed Dark Falls LLC, a shell company presented as a software development business. Authorities also dismantled more than 40 laptop farms in Texas during raids conducted from September 21 to 25, 2026. The alleged scheme operated from about 2019 through July 2025.

The alleged scheme was large enough to reach more than 70 U.S. company employers. It generated approximately $3 million in revenue for the IT workers, according to the article. Those figures show how remote hiring could become a sustained funding channel rather than a single isolated fraud.

The operation also involved physical infrastructure. Authorities dismantled more than 40 laptop farms across Texas during raids conducted between September 21 and 25, 2026. These locations hosted employer-provided computers so overseas workers could use remote-access technology while appearing to work from the United States.

Victims came from health care, communications, cyber support, retail, and manufacturing. Companies were located in Ohio and many other states, including California, New York, Texas, and Pennsylvania. The campaign continues as U.S. authorities seek to cut off North Korea’s alleged revenue source and disrupt an evolving threat.

The alleged fraud connected identity deception, remote work, and money movement into one system. North Korean IT workers used fake identities to secure jobs at American and other companies. Their salaries then became a source of illicit revenue for the DPRK, allegedly in violation of international sanctions.

Facilitators helped workers pass hiring processes and hosted company-issued laptops at U.S. residences. Remote-access tools let overseas workers operate those machines, making them appear to be local employees. Facilitators also set up U.S. bank accounts and online money-transfer services. Those accounts received payments from victim companies and enabled money to move to workers and others abroad.

The facilitators were paid fees for providing these services. The operation used shell-company infrastructure, including Dark Falls LLC, which allegedly claimed to provide software development. The article describes more than 70 affected employers and approximately $3 million generated for IT workers.

When a company unknowingly hires a fraudulent worker, it may pay someone using a false identity and unknowingly support the alleged funding network. The article also shows that employers supplied laptops, which were redirected to or hosted at laptop farms. This creates exposure involving company equipment, access, finances, and confidence in remote hiring.

The victims included health care, communications, cyber support, retail, and manufacturing companies. In this operation, overseas workers used remote-access technology through employer-issued computers hosted in U.S. residences. The article does not document a specific data breach or customer loss, but unauthorized access to company systems can create those risks and can damage customer trust if discovered.

The alleged scheme affected more than 70 U.S. employers across many states. Companies therefore face both immediate investigative costs and the challenge of verifying remote workers’ identities and locations. The operation’s use of replacement shipments, address changes, and staffing firms shows why equipment controls matter alongside hiring checks.

The money earned through these jobs allegedly violated international sanctions because it generated revenue for the Democratic People’s Republic of Korea. The indictment describes the work as part of a scheme designed to send illicit funds to the DPRK government. Sanctions aim to restrict such financial support.

The workers used fake identities to obtain regular salaries from U.S. and other companies. Facilitators helped route payments through U.S. bank accounts and online money-transfer services. The article says a portion of the earnings was funneled back to the regime. Approximately $3 million in revenue was generated for IT workers in the alleged operation.

Court documents allege that the money helped fund North Korea’s nuclear weapons and other military programs. That makes ordinary-looking payroll payments part of a broader national-security concern. The U.S. campaign seeks to cut off this revenue source and dismantle an evolving cyber threat whose scale is described as likely vast.

Remote hiring systems can be vulnerable when employers mainly trust digital identities, online interviews, and supplied documents. A worker may appear legitimate while another person, a false address, or a remote operator controls the work. The article shows that laptop farms and staffing firms could obscure the true location of workers and devices.

More difficult-to-fake checks could include repeated live identity verification, secure document validation, location checks, and confirmation that the worker controls the declared device and address. Employers could also track device changes, unusual remote-access patterns, shipping diversions, and repeated residential addresses. These safeguards address the specific tactics described in the article, including replacement shipments and device-hash spoofing.

The article does not prescribe a single verification system. It does show that checks should continue after hiring, not stop at onboarding. Companies could review access and payment patterns, verify staffing-firm referrals, and investigate unexplained relocations. Layered checks would make it harder to hide a worker’s identity or operating location.