DOJ seizes 187 laptops in raids on more than 40 Texas homes tied to North Korean IT workers
DOJ raided more than 40 Texas residences on September 21-25 and seized 187 laptops and other devices it says North Koreans used in an IT-worker scheme. The FBI says the workers now also hire freelancers in South Asia and West Africa, so US hosts are one intermediary among several.
The Watch · Security desk
Key figures: prosecutors said Bostelle and Pena helped a group of North Koreans earn more than $3 million from about 70 US companies. Separately, such schemes have earned millions over the last eight years.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Earned by North Koreans the pair helped, more than | $3 million | 4 | |
| US companies paid, about | 70 companies | 4 | |
| Years such schemes have earned millions | 8 years | Such schemes overall, not only this pair | 13 |
What happened
- Alongside the raids, DOJ indicted and arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on wire fraud, money laundering and identity theft charges.
- The pair helped a group of North Koreans earn more than $3 million from about 70 US companies in 17 states, prosecutors said, including healthcare, cybersecurity, retail and manufacturing firms.
- Large parts of the indictment center on Trey Michael Nolte, who was not charged; prosecutors said he ran a shell company that facilitated the scheme.
- From 2019 to 2026, prosecutors said, Bostelle and Pena hosted laptops and helped IT workers use fake identification documents to get hired or verify bank accounts.
- Several Americans who ran laptop farms and worked with North Koreans have already been convicted and given prison terms of years.
Why it matters
- What doesn't add up contradiction DOJ did not answer whether the arrests connect to the Texas raids, and Bostelle is listed as of Pennsylvania. On this record the 187 seized devices cannot be attributed to the two charged men.
- Who's exposed exposure If a paid freelancer sits the interview, an identity check made only on that call verifies the freelancer. Hiring-stage verification alone does not reach the person who later does the work.
- Who has to decide decision Employers choosing where to verify have two records the indictment implicates: the address a company laptop ships to and the account its pay goes to.
- What it sets up precedent We'd expect more cases against hosts and identity sellers, because DOJ describes its operation as long-running and aimed at identifying American co-conspirators.
Next story · Build · 2d ago
Prosecutors say North Korean remote workers got into at least 70 US companiesConfirmed5 publishers
Nolte is where the domestic-facilitator case is strongest. Prosecutors allege he was in contact with Chinese and North Korean nationals, brought in Bostelle, shipped packages to China, took in work laptops issued by US companies and laundered the paychecks back to North Korea [7]. The DOJ did not explain why he was not charged [6].
The FBI's account shows hosts and coordinators are one layer. Its new public service announcement says North Korea is taking significant steps to counter US companies' efforts to stop the scheme, and is subcontracting entire jobs to third parties in South Asia or West Africa while hiring facilitators for a wider array of tasks [11]. The advisory says North Koreans "pay these freelancers to apply manually to as many open positions as possible over a given time-period, or to conduct interviews on their behalf" [12].
We think the FBI is describing a campaign that adapts to enforcement, and the dates fit. Such schemes have earned millions over eight years by tricking US companies into remote hires with stolen or purchased identities [13]. Law enforcement raided nearly 30 laptop farms across 16 states last year [8] and more than 40 Texas residences in September [1]. Farms and residences are different units, so the two counts do not compare directly.
On payroll alone, more than $3 million across about 70 companies averages roughly $43,000 per company [15]. Assistant Attorney General for National Security John Eisenberg named a different harm to employers. "These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft," he said [14].
What to watch
- Whether DOJ filings or a statement tie the 187 seized devices to Bostelle and Pena Carrillo.
- Whether Nolte, whom prosecutors describe as running the shell company, is charged.
- Whether any charges reach the South Asian or West African freelancers the FBI describes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence78
Perspective Coverage
17 publishers- Builder
- Builder 25%
- Operator
- Operator 55%
- Investor
- Investor 20%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The DOJ's laptop farm raids, conducted September 21-25, targeted more than 40 residences across Texas.
- [2]
Law enforcement seized 187 laptops and other devices used by North Koreans.
- [3]
Alongside the raids, the DOJ indicted and arrested US nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on wire fraud, money laundering and identity theft charges.
- [4]
Bostelle and Pena helped a group of North Koreans earn more than $3 million from about 70 US companies across 17 states, including organizations in healthcare, cybersecurity, retail and manufacturing, prosecutors said.
- [5]
Large parts of the indictment center on US national Trey Michael Nolte, who was not charged; prosecutors said he ran a shell company that facilitated the scheme.
- [6]
The DOJ did not explain why Nolte was not charged.
- [7]
Nolte allegedly communicated with Chinese and North Korean nationals, recruited Bostelle, sent packages to China, received work laptops from US companies and laundered the paychecks earned by the IT workers back to North Korea.
- [8]
Nearly 30 laptop farms across 16 states were raided last year by US law enforcement.
- [9]
Several Americans have already been convicted and sentenced to years in prison for running laptop farms and coordinating with North Koreans on the IT worker scheme.
- [10]
The actions outlined are part of a long-running operation to disrupt laptop farms across the US and to identify American co-conspirators who sell their identities for use or host laptop farms at their properties.
- [11]
The FBI's new public service announcement says North Korea is taking significant steps to counter efforts by US companies to stop the scheme, and the operations are subcontracting entire jobs to third parties in South Asia or West Africa and hiring facilitators to conduct a wider array of tasks.
- [12]
The FBI advisory said North Koreans "pay these freelancers to apply manually to as many open positions as possible over a given time-period, or to conduct interviews on their behalf".
- [13]
Such schemes have earned millions over the last eight years by tricking US companies into hiring workers remotely into lucrative IT roles through stolen or purchased identities.
- [14]
Assistant Attorney General for National Security John Eisenberg said: "These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft."
- [15]
More than $3 million across about 70 companies averages roughly $43,000 per company.
- [16]
The DOJ did not respond to requests for comment about whether the indictments and arrests were linked to the Texas laptop farm raids.
- [17]
From 2019 to 2026, Bostelle and Pena hosted laptops as part of the scheme while also helping IT workers obtain and use fake identification documents to obtain employment or verify bank accounts, prosecutors said.
Sources
17 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
1 article · October 14, 2026
- cbsnews.comNorth Texas federal officials promise indictments after busting alleged North Korean "laptop farms" - CBS Texas
1 article · October 13, 2026
- crowdstrike.comU.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
1 article
- crypto.newsNorth Korean IT fraud case cites crypto transfers in alleged $3m scheme
1 article · October 13, 2026
- cyberscoop.comDOJ charges 14 over a sprawling North Korean remote work scheme
1 article · October 13, 2026
- dev.toLaptop farms y el fraude norcoreano que burló a 70 firmas
1 article · October 15, 2026
- helpnetsecurity.comFBI raids 40+ laptop farms helping North Korea pocket US tech salaries
1 article · October 14, 2026
- itnews.com.auUS raids 40 laptop farms for North Korean IT workers - iTnews
1 article
- itpro.comUS raids laptop farms used to funnel $3 million to North Korea in fake candidate scam
1 article · October 14, 2026
- justice.govNorthern District of Texas | Operation Lonestar Roundup dismantles North Korean IT worker network used to penetrate U.S. companies in Texas | United States Department of Justice
2 articles · October 13, 2026
- FBI uproots over 40 of North Korea’s US laptop farms
metacurity.com
1 article · October 14, 2026
- nextgov.comFBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies - Nextgov/FCW
1 article · October 13, 2026
- securityweek.comUS Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
1 article · October 14, 2026
- techtimes.comFBI Seizes 187 KVM Devices Across Texas Laptop Farms Bankrolling DPRK Weapons Program
1 article · October 13, 2026
- thecyberexpress.comFBI Warns North Korean IT Workers Now Recruit Americans
2 articles · October 14, 2026
- thehackernews.comU.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
1 article · October 14, 2026
- therecord.mediaTwo arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
1 article · October 13, 2026
Topics and entities
Topics
- Remote hiring security
- Identity Fraud
- Laptop farms
- Sanctions Evasion
- North Korean IT workers
Entities
- Operation Lonestar Roundup
- U.S. Department of Justice
- Famous Chollima
- Federal Bureau of Investigation
- CrowdStrike