Federal agents raided more than 40 North Korean laptop farms in Texas. The FBI says employers hiring remote workers are the front line

Federal prosecutors on Tuesday, October 13, 2026, unsealed an indictment charging 14 people in a North Korean remote IT worker scheme that allegedly placed operatives inside more than 70 U.S. companies, and announced that FBI agents had searched more than 40 residences across Texas used as so-called laptop farms. The same day, the FBI issued a public warning that North Korean workers are recruiting more Americans to help them, subcontracting work to freelancers abroad and, in some cases, threatening former managers after being fired.

The case is a national security story, but its victims were ordinary employers: health care, communications, cyber support, retail and manufacturing companies spread across 17 states and the District of Columbia. Any business that hires remote technical staff, or uses contractors it has never met in person, is the target audience for what the government published this week.

What did the Justice Department announce?

The indictment was unsealed in the Northern District of Ohio, according to CyberScoop. Two U.S. citizens were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. The indictment also names ten defendants located in China, and two more remain under seal, according to Help Net Security. The charges include wire fraud conspiracy, money laundering conspiracy and identity theft offenses, as reported by The Hacker News. These are allegations, and the defendants have not been convicted.

Prosecutors allege that from 2019 to about July 2025 the group used stolen or fabricated identities to land remote jobs at more than 70 companies, generating about $3 million in pay. According to CyberScoop's account of the indictment, an uncharged Ohio man allegedly kept roughly two dozen company laptops online for overseas workers and moved more than $320,000 through accounts opened under false names, while Carrillo allegedly hosted laptops at his home and received about $190,000 from five employers. Prosecutors also allege false employment records were filed with federal agencies using the identities of more than 25 identity theft victims.

Separately, the U.S. Attorney's Office for the Northern District of Texas described Operation Lonestar Roundup, in which agents searched more than 40 residences and seized 187 laptops and keyboard, video and mouse (KVM) devices, about 100 of them in North Texas. Help Net Security reported the searches took place September 21 to 25. The cybersecurity firm CrowdStrike assisted and tracks the group under the name Famous Chollima.

R. Joseph Rothrock, special agent in charge of the FBI's Dallas office, put the scale plainly: "Each laptop seized potentially represents one company that has hired a DPRK IT worker."

How does a laptop farm scheme work?

The method is simple, which is why it works. A North Korean worker applies for a remote job using a real American's stolen identity or a fabricated one, often with a polished resume, a realistic email address and online profiles. After the hire, the company ships a laptop to an address in the United States. A paid facilitator at that address plugs it in, installs remote access software or a hardware KVM device, and keeps it running so the worker abroad can log in and appear to be working from a U.S. home.

CrowdStrike told Help Net Security that laptop farms solve problems operatives cannot handle from overseas: receiving and configuring hardware, getting past location-based fraud checks and passing identity verification. The worker collects a salary, and the FBI says most of the money flows back to North Korea. Help Net Security, citing the FBI warning, reported that the North Korean government receives an estimated 85% to 90% of the workers' revenue.

What is the FBI warning employers about now?

The FBI's public service announcement, alert number I-101326-PSA, describes a scheme that is adapting. Key points from the alert:

• More American helpers. Workers increasingly pay U.S. residents to host laptops, apply for jobs, sit for interviews, verify fake identities or lend their social media and professional accounts. The FBI says they target people under financial strain.
• Subcontracting abroad. Some workers who land jobs pass the actual work to freelancers, mainly in South Asia and West Africa, for a fraction of the salary.
• Extortion and threats. The FBI reported cases of threats of violence against former managers and their families, and threats to leak company data unless paid.
• Higher-value targets. Workers seek positions with cleared defense contractors and other government contractors.
• No single tell. The FBI says no one indicator reliably identifies these workers, because their behavior overlaps with legitimate remote work.

Help Net Security also noted earlier reporting that suspected North Korean workers have moved beyond software jobs into sales, marketing and health care roles, which widens the pool of companies at risk beyond the tech sector.

What should a business that hires remote workers do?

The FBI recommends what it calls an identity in depth approach: layered checks that continue through the whole employment relationship rather than a single background check at hiring. The alert's specific recommendations translate into a practical checklist for small and midsize employers:

1. Verify identity live and more than once. The FBI suggests options such as E-Verify, requiring multiple forms of ID or a U.S. passport, and live identity verification. A short, unscheduled video call with the camera on, after hiring, is a low-cost add.
2. Control where company laptops go. Ship equipment only to the address on verified identity documents, and question requests to send it elsewhere.
3. Watch for remote access tools. The FBI lists software such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop and Splashtop Streamer, plus remote monitoring and management tools that the company did not install.
4. Look for remote control hardware. KVM-over-IP devices, including TinyPilot, PiKVM and GL.iNet units, can let someone control a laptop from another machine.
5. Flag frequent identity changes. Unusually frequent changes to bank accounts, home addresses or social media accounts can signal trouble.
6. Get IT, HR and management talking. The FBI says the pieces of evidence often sit in different departments. A payroll change, an odd login location and a manager's concern about camera-off meetings mean more together than apart.

The FBI also cautions against blunt filters. Ban lists and name-based screening can be unreliable, can exclude qualified applicants and can harm the real people whose identities were stolen. The bureau advises tuning detection rules carefully and reviewing results rather than acting on a single alert. Companies with questions about employment screening rules should consult an employment attorney, since identity checks must be applied consistently and lawfully.

What if a business suspects it hired one?

The FBI asks companies to report information through the Internet Crime Complaint Center at ic3.gov. Before confronting a suspected worker, security professionals generally advise preserving logs and limiting the person's access to sensitive data quietly, because the FBI's own alert describes extortion attempts after firings. A company with cyber insurance should also notify its carrier, which may require prompt reporting and can provide incident response help.

Individuals approached with offers to host laptops or lend their identity for a remote job should know the FBI's warning: taking part is illegal and exposes people to criminal investigation. Two New Jersey men were sentenced in April 2026 to nine and nearly eight years in prison in an earlier scheme that generated $5 million for North Korea, according to Help Net Security.

What to watch next

The Northern District of Texas said its investigation is ongoing and more details will follow, and two defendants in the Ohio case remain under seal, so additional charges are possible. Watch for whether prosecutors identify more facilitators from the 187 seized devices, since each one may point to another employer. For businesses, the more immediate question is internal: whether anyone hired remotely in the last few years has been verified beyond a resume and a video interview. A review of remote access software on company laptops and of recent payroll changes is a reasonable step to take this quarter, regardless of company size.