From 2019 to 2026, Juan Cecilio Pena Carrillo kept employer-issued laptops at his Texas home under various names, prosecutors allege. They say he received about $190,000 from five employers while overseas North Korean workers used the equipment to take remote jobs.
Michael James Bostelle, of Pennsylvania, is accused of doing the same from his home. Prosecutors say he also supplied his name and a fraudulent driver’s licence to help a remote worker secure a job.
The arrangement, authorities say, relied on US-based facilitators receiving company laptops and allowing overseas workers to operate them through remote-access software or hardware. That made the workers appear to be in the United States and gave them access to company systems.
On 13 October 2026, the Justice Department announced the arrests of Bostelle and Carrillo and unsealed an indictment naming 14 people, including 10 China-based defendants described as overseas coordinators.
Bostelle faces charges of conspiracy to commit wire and mail fraud, money laundering conspiracy and conspiracy to commit identity theft. Carrillo faces the same charges, along with aggravated identity theft.
According to the indictment, North Korean workers sought contractor and full-time roles at US companies using stolen or fabricated American identities, invented employment histories and AI-generated photographs. The facilitators allegedly received wages before sending money abroad, including through cryptocurrency.
Prosecutors say the scheme generated approximately $3 million for overseas IT workers, with money routed to North Korean-controlled accounts. They also allege that Bostelle and Carrillo filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration using the identities of more than 25 theft victims.
Trey Michael Nolte, an Ohio resident, was named as a co-conspirator and had not been charged as of Tuesday’s announcement. Prosecutors allege that he recruited, managed and trained Bostelle and other US nationals, and kept roughly two dozen company laptops online for overseas workers while moving more than $320,000 through accounts opened under false names.
The FBI searched more than 40 Texas residences between 21 September and 25 September 2026, targeting addresses known or suspected to be laptop farms. Agents seized approximately 187 laptops and keyboard-video-mouse devices, including roughly 100 devices in North Texas.
Federal authorities called the operation, known as Operation Lonestar Roundup, the largest single-state enforcement action so far against North Korea’s state-directed effort to place IT workers in American companies under stolen identities.
R. Joseph Rothrock, the FBI Dallas special agent in charge, said: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.”
The Justice Department said the investigation remains ongoing. Prosecutors say the operation disrupted a scheme affecting more than 70 US companies and government agencies across 17 states in healthcare, cybersecurity, retail and manufacturing.
John Eisenberg, the assistant attorney general for national security, said: “North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies.”
US law enforcement raided nearly 30 laptop farms across 16 states last year.
Comments (0)