DOJ Arrested Two for North Korean Laptop Farm Scheme
The operation enabled North Korean IT workers to infiltrate U.S. corporate networks by posing as domestic employees.
Updated on Oct. 13, 2026 in Financial Crime
Live Poll
Do you trust that U.S. companies have sufficient safeguards to prevent fraudulent foreign remote hiring?
The U.S. Department of Justice arrested two Americans for operating a laptop farm that enabled North Korean IT workers to pose as U.S. employees. The scheme successfully infiltrated more than 70 U.S. companies to steal data and generate millions for the North Korean government.
Why it matters
This elaborate fraud compromised the identities of 25 Americans to bypass corporate security and funnel revenue directly to overseas actors. It highlights persistent vulnerabilities in remote hiring practices used by foreign entities to gain unauthorized network access.
The FBI seized 187 laptops and devices during raids on 40 Texas residences. Michael James Bostelle and Juan Ceclilio Pena Carrillo face charges of wire fraud, money laundering, and identity theft, while 10 additional co-conspirators were indicted in China.
The players
Michael James Bostelle
A defendant residing in Pennsylvania who was arrested for his role in operating the illegal laptop farm.
Juan Ceclilio Pena Carrillo
A co-defendant arrested in connection to the scheme that facilitated North Korean IT worker infiltration.
U.S. Department of Justice
The federal executive department responsible for the enforcement of the law and the administration of justice in the United States.
Federal Bureau of Investigation
The domestic intelligence and security service of the United States that conducted the search and seizure operation.
The details
Operators hosted laptops in their homes to trick employers into believing the workers were based in the U.S. The scheme relied on the theft of personal information from 25 Americans to create fake digital personas for North Korean-directed IT contractors.
Timeline
Between September 21 and September 25, 2026, the FBI searched more than 40 residences in Texas.
On October 13, 2026, the Department of Justice announced the arrests and unsealed the indictment.
Legal Context
This case follows a pattern set by the 2024 U.S. government warning on North Korean IT worker schemes. It represents a significant escalation in the federal crackdown on fraudulent remote work operations designed to bypass national cybersecurity infrastructure.
The compromise of 25 American identities underscores the risks to citizens whose personal data may be used by foreign actors without their knowledge. Employers are cautioned to verify remote hiring credentials more strictly to ensure that employees are who they claim to be.
The takeaway
This case serves as a stark reminder that remote work credentials can be weaponized for national security breaches. Individuals should regularly monitor their credit reports and employment histories to ensure their identities have not been misappropriated by illicit groups.
Further reading
For broader trends in illicit fiscal activity, see our Financial Crime section.
Live Poll
Do you trust that U.S. companies have sufficient safeguards to prevent fraudulent foreign remote hiring?
