U.S. Shuts Down 40 Laptop Farms and Charges 14 in North Korean IT Scheme

The U.S. Department of Justice has charged 14 individuals and seized roughly 187 computers as part of an ongoing enforcement operation targeting fraudulent remote IT worker schemes operated by North Korea. The multi-year conspiracy affected more than 70 U.S. companies across industries including healthcare, communications, retail, and manufacturing.

The indictment filed in federal court charges a mix of U.S. citizens and foreign nationals with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft. Two U.S. nationals, Juan Cecilio Pena Carrillo and Michael James Bostelle, have been arrested, while the remaining defendants remain at large.

Federal law enforcement officials also dismantled more than 40 so-called laptop farms located across Texas during a series of raids conducted between September 21 and 25, 2026. Investigators stated that the network operated from approximately 2019 to July 2025 to generate illicit revenue for the government of the Democratic People’s Republic of Korea, helping to fund its military and weapons programmes in violation of international sanctions.

The operation, also tracked under threat intelligence names such as Famous Chollima and Wagemole, relies on North Korean operatives securing remote technical roles at Western firms using fabricated identities. U.S.-based facilitators assist these workers by hosting company-issued hardware at residential addresses, deploying remote-access technology to disguise the operators’ true geographical locations, and managing domestic bank accounts to launder earnings.

According to cybersecurity researchers at CrowdStrike, the threat actors employed various tactics to divert employer-provided hardware during the onboarding phase. Operatives filed fraudulent police reports for stolen devices to trigger replacement shipments, rotated residential addresses, and exploited third-party IT staffing firms to route endpoint hardware directly to laptop farm infrastructure.

The Federal Bureau of Investigation has issued a parallel advisory warning that these networks have increasingly expanded their use of domestic and international facilitators. In some cases, North Korean operators have subcontracted programming assignments to third-party freelancers located in South Asia and West Africa, while also leveraging stolen identities and coercing vulnerable individuals to act as local proxies.

Security investigators note that while the disruption of the Texas laptop farm infrastructure will temporarily impede local operations, threat actors will likely continue to adapt their methodologies to evade detection.