The U.S. Department of Justice (DOJ) has disrupted a network of laptop farms in Texas allegedly operated by North Korean nationals, which facilitated a scheme that generated over $3 million from U.S. companies. The raids, conducted between September 21 and 25, targeted more than 40 residences, resulting in the seizure of 187 laptops and other devices used in the operation.
According to the DOJ, the laptop farms were part of a broader scheme that has been in operation for nearly eight years, tricking U.S. companies into hiring remote IT workers through stolen or purchased identities. The DOJ has indicted and arrested two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, who are accused of being key facilitators in this operation. They face charges of wire fraud, money laundering, and identity theft.
Details of the Operation
Prosecutors allege that Bostelle and Pena helped North Korean nationals earn substantial sums from approximately 70 U.S. companies across 17 states, including sectors such as healthcare, cybersecurity, retail, and manufacturing. The indictment also references Trey Michael Nolte, who allegedly ran a shell company that supported the scheme but has not been charged. Nolte is said to have communicated with North Korean and Chinese nationals, facilitated the recruitment of Bostelle, and laundered payments back to North Korea.
Assistant Attorney General for National Security John Eisenberg emphasized the threat posed by such schemes, stating, “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies.”
Changing Tactics and Broader Implications
As part of ongoing efforts to combat these operations, the FBI has noted that North Korea is adapting its tactics. The agency released a public service announcement detailing how North Korean IT workers are now subcontracting jobs to third parties in South Asia and West Africa. This shift allows them to circumvent U.S. efforts to disrupt their operations.
North Korean nationals are reportedly targeting low-income Americans, offering freelance gigs that involve hosting laptops or participating in job interviews on behalf of the North Koreans. The FBI has observed that these workers often pose as Chinese or East Asian nationals needing temporary U.S. presence or as Eastern Europeans displaced by the ongoing conflict in Ukraine.
Furthermore, the FBI has warned that when caught, North Korean operatives have resorted to intimidation tactics, including threats of violence and the potential leaking of sensitive corporate data if demands are not met. This underscores the serious implications of these schemes not only for the individuals involved but also for the security of U.S. companies and their data.
The DOJ’s recent actions are part of a larger initiative to dismantle laptop farms across the U.S. and identify American co-conspirators who facilitate these operations. Previous efforts have already led to the conviction of several individuals involved in similar schemes, highlighting the ongoing challenge posed by North Korean cyber operations.
For more details on the evolving tactics of North Korean IT workers and the implications for U.S. cybersecurity, see the full report from The Record.
