North Korean IT Workers Allegedly Used Fake Identities to Get Jobs at 70 US Firms
By Anjali Sharma
WASHINGTON – US federal investigators on Wednesday searched over 40 Texas residences, where company-issued computers allegedly allowed overseas workers to access American corporate networks, as per media reports.
The FBI has issued a fresh warning about the use of local facilitators to bypass employment screening.
Anetwork of computers hidden inside American homes allegedly helped North Korean technology workers secure jobs at more than 70 US companies and generate approx $3 million, exposed an elaborate scheme that federal investigators say was used to funnel money to the sanctioned regime.
US Department of Justice announced charges against 14 people and the arrest of two American nationals after a coordinated investigation that also led to the seizure of approximately 187 computer devices.
Investigators said the operation relied on stolen or fabricated American identities, remote-access software, and computers maintained at residential properties to conceal the workers’ actual locations overseas.
The alleged conspiracy affected companies across 17 states and Washington, DC, including businesses in healthcare, communications, cyber security support, retail and manufacturing.
According to prosecutors, the revenue generated through the fraudulent employment arrangements is believed to have reached entities controlled by North Korea.
A 58-page indictment, returned by a federal grand jury in Ohio on October 1, alleged that the network operated between 2019 and approximately July 2025.
North Korean information technology workers allegedly used false identity documents, virtual private networks, and other digital tools to apply for and obtain remote employment at American businesses.
The facilitators based in the US received company-issued laptops and installed software that allowed overseas workers to access them remotely to maintain the deception.
The computers were housed at residential properties known as “laptop farms”.
These arrangements allegedly allowed foreign workers to access corporate systems while creating the impression that they were physically present in the United States.
Federal authorities identified the alleged offences as conspiracy to commit wire fraud, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft.
The FBI searched over 40 residences in Texas under an initiative called Operation Lonestar Roundup between September 21 and 25.
The agents seized 187 laptops and keyboard-video-mouse devices suspected of facilitating remote access to American corporate networks.
Cyber security firm Crowd Strike has identified the North Korean worker network and its facilitators as “Famous Chollima”.
The investigation also led to the arrests of Michael James Bostelle, 31, of Philadelphia, Pennsylvania, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas.
Both men were named in the indictment unsealed by federal prosecutors in Ohio.
Some 10 China-based defendants were also charged, while the identities of two additional defendants remain under seal.
US Attorney Ryan Raybould for the Northern District of Texas said the investigation exposed a broader national security threat.
“This investigation is about far more than fraud,” Raybould said.
“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders,” he added.
Federal authorities said such arrangements can give foreign operatives access to corporate networks while allowing sanctioned North Korean entities to benefit financially from employment contracts.
The Justice Department has warned that North Korean remote workers have also engaged in data theft and extortion against American businesses.
The FBI issued a fresh advisory warned that North Korean operatives were increasingly recruiting American facilitators and, in some cases, subcontracting entire jobs to third-party foreign nationals to evade detection.
The latest action forms part of a wider Justice Department and FBI initiative targeting networks that allegedly generate illicit revenue for North Korea.
The investigation is still ongoing. The charges are allegations, and all defendants are presumed innocent unless proven guilty in court.
