Department of Justice Charges 14 Over North Korean Remote Work Scheme

Federal authorities announced charges against 14 people linked to a remote work scheme used by North Korea. The Justice Department unsealed an indictment on Tuesday after seizing roughly 187 computers during raids. This effort aims to disrupt how the country earns money from American companies through stolen identities.

Prosecutors charged two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, with wire fraud and identity theft. A third person, Trey Michael Nolte, was named as a co-conspirator but not charged. Reports differ on the timeline of their work, with one stating it lasted through 2025 while another extends hosting duties to 2026.

The scheme allegedly generated about $3 million for North Korean nationals working at over 70 U.S. companies. These organizations include firms in healthcare, cybersecurity, retail, and manufacturing across 17 states. Authorities say the money earned from high-paying IT roles funnels directly into the government's programs.

Law enforcement targeted more than 40 residences in Texas known or suspected to operate as laptop farms. Investigators searched these locations between September 21 and 25, taking control of electronic devices used by foreign workers. A U.S. attorney described the operation as a message that enemies will not be allowed to exploit American businesses.

The FBI released a public advisory highlighting how the group targets people under financial strain. New tactics include hiring freelancers in Pakistan, India, and Nigeria to handle job applications or interviews on behalf of North Korean operatives. These facilitators often claim to be Eastern Europeans displaced by war to explain their U.S. presence.

Intimidation remains a key tool for the group when they are caught or investigated. The FBI reported threats against former managers after firings and demands for payment backed by stolen data. Paid helpers were also sent to appear in person at companies to threaten staff who removed accounts linked to the scheme.

Detection efforts face challenges as the group spoofs device identifiers to hide their activities. CrowdStrike noted that a video capture card can appear as a webcam, making single warning signs difficult to spot. The group has been changing how they use tools since May to resemble normal remote work behavior.

Despite the takedown, security firms warn the action may not stop the broader scheme long-term. The State Department is offering rewards of up to $5 million for information that disrupts the network further. Prosecutors continue to seek American co-conspirators who sell identities or host equipment at their properties.