DOJ seizes 187 laptops in raids on more than 40 Texas homes tied to North Korean IT workers
DOJ raided more than 40 Texas residences on September 21-25 and seized 187 laptops and other devices it says North Koreans used in an IT-worker scheme. The FBI says the workers now also hire freelancers in South Asia and West Africa, so US hosts are one intermediary among several.
The Watch · Security desk
Key figures: prosecutors said Bostelle and Pena helped a group of North Koreans earn more than $3 million from about 70 US companies. Separately, such schemes have earned millions over the last eight years.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Earned by North Koreans the pair helped, more than | $3 million | 3 | |
| US companies paid, about | 70 companies | 3 | |
| Years such schemes have earned millions | 8 years | Such schemes overall, not only this pair | 11 |
What happened
- Alongside the raids, DOJ indicted and arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on wire fraud, money laundering and identity theft charges.
- The pair helped a group of North Koreans earn more than $3 million from about 70 US companies in 17 states, prosecutors said, including healthcare, cybersecurity, retail and manufacturing firms.
- Large parts of the indictment center on Trey Michael Nolte, who was not charged; prosecutors said he ran a shell company that facilitated the scheme.
- From 2019 to 2026, prosecutors said, Bostelle and Pena hosted laptops and helped IT workers use fake identification documents to get hired or verify bank accounts.
- Several Americans who ran laptop farms and worked with North Koreans have already been convicted and given prison terms of years.
Why it matters
- contradiction DOJ did not answer whether the arrests connect to the Texas raids, and Bostelle is listed as of Pennsylvania. On this record the 187 seized devices cannot be attributed to the two charged men.
- exposure If a paid freelancer sits the interview, an identity check made only on that call verifies the freelancer. Hiring-stage verification alone does not reach the person who later does the work.
- decision Employers choosing where to verify have two records the indictment implicates: the address a company laptop ships to and the account its pay goes to.
- precedent We'd expect more cases against hosts and identity sellers, because DOJ describes its operation as long-running and aimed at identifying American co-conspirators.
Nolte is where the domestic-facilitator case is strongest. Prosecutors allege he was in contact with Chinese and North Korean nationals, brought in Bostelle, shipped packages to China, took in work laptops issued by US companies and laundered the paychecks back to North Korea [10]. The DOJ did not explain why he was not charged [9].
The FBI's account shows hosts and coordinators are one layer. Its new public service announcement says North Korea is taking significant steps to counter US companies' efforts to stop the scheme, and is subcontracting entire jobs to third parties in South Asia or West Africa while hiring facilitators for a wider array of tasks [12]. The advisory says North Koreans "pay these freelancers to apply manually to as many open positions as possible over a given time-period, or to conduct interviews on their behalf" [13].
We think the FBI is describing a campaign that adapts to enforcement, and the dates fit. Such schemes have earned millions over eight years by tricking US companies into remote hires with stolen or purchased identities [11]. Law enforcement raided nearly 30 laptop farms across 16 states last year [5] and more than 40 Texas residences in September [1]. Farms and residences are different units, so the two counts do not compare directly.
On payroll alone, more than $3 million across about 70 companies averages roughly $43,000 per company [15]. Assistant Attorney General for National Security John Eisenberg named a different harm to employers. "These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft," he said [14].
What to watch
- Whether DOJ filings or a statement tie the 187 seized devices to Bostelle and Pena Carrillo.
- Whether Nolte, whom prosecutors describe as running the shell company, is charged.
- Whether any charges reach the South Asian or West African freelancers the FBI describes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap+25
- Incentives50
- Confidence68
Perspective Coverage
5 publishers- Builder
- Builder 10%
- Operator
- Operator 72%
- Investor
- Investor 18%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The DOJ's laptop farm raids, conducted September 21-25, targeted more than 40 residences across Texas.
- [2]
Law enforcement seized 187 laptops and other devices used by North Koreans.
- [3]
Bostelle and Pena helped a group of North Koreans earn more than $3 million from about 70 US companies across 17 states, including organizations in healthcare, cybersecurity, retail and manufacturing, prosecutors said.
- [4]
Alongside the raids, the DOJ indicted and arrested US nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on wire fraud, money laundering and identity theft charges.
- [5]
Nearly 30 laptop farms across 16 states were raided last year by US law enforcement.
- [6]
Several Americans have already been convicted and sentenced to years in prison for running laptop farms and coordinating with North Koreans on the IT worker scheme.
- [7]
The actions outlined are part of a long-running operation to disrupt laptop farms across the US and to identify American co-conspirators who sell their identities for use or host laptop farms at their properties.
- [8]
Large parts of the indictment center on US national Trey Michael Nolte, who was not charged; prosecutors said he ran a shell company that facilitated the scheme.
- [9]
The DOJ did not explain why Nolte was not charged.
- [10]
Nolte allegedly communicated with Chinese and North Korean nationals, recruited Bostelle, sent packages to China, received work laptops from US companies and laundered the paychecks earned by the IT workers back to North Korea.
- [11]
Such schemes have earned millions over the last eight years by tricking US companies into hiring workers remotely into lucrative IT roles through stolen or purchased identities.
- [12]
The FBI's new public service announcement says North Korea is taking significant steps to counter efforts by US companies to stop the scheme, and the operations are subcontracting entire jobs to third parties in South Asia or West Africa and hiring facilitators to conduct a wider array of tasks.
- [13]
The FBI advisory said North Koreans "pay these freelancers to apply manually to as many open positions as possible over a given time-period, or to conduct interviews on their behalf".
- [14]
Assistant Attorney General for National Security John Eisenberg said: "These schemes threaten the security of the IT systems and data of the deceived U.S. employers and leave countless victims of identity theft."
- [15]
More than $3 million across about 70 companies averages roughly $43,000 per company.
- [16]
The DOJ did not respond to requests for comment about whether the indictments and arrests were linked to the Texas laptop farm raids.
- [17]
From 2019 to 2026, Bostelle and Pena hosted laptops as part of the scheme while also helping IT workers obtain and use fake identification documents to obtain employment or verify bank accounts, prosecutors said.
Sources
5 independent publishers whose own reporting we read for this story.
- crypto.newsNorth Korean IT fraud case cites crypto transfers in alleged $3m scheme
1 article · October 13, 2026
- cyberscoop.comDOJ charges 14 over a sprawling North Korean remote work scheme
1 article · October 13, 2026
- justice.govNorthern District of Texas | Operation Lonestar Roundup dismantles North Korean IT worker network used to penetrate U.S. companies in Texas | United States Department of Justice
2 articles · October 13, 2026
- nextgov.comFBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies - Nextgov/FCW
1 article · October 13, 2026
- therecord.mediaTwo arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Cybercrime Law Enforcement OperationsFollow
- Identity FraudFollow
- Laptop farmsFollow
- North Korean IT worker schemesFollow