Federal prosecutors in Ohio have charged two American men, one from Philadelphia and one from Texas, with helping North Korean IT workers land remote positions at more than 70 U.S. companies. The workers allegedly used stolen or fake identities to collect paychecks that largely returned to the regime in Pyongyang.

Authorities charged 14 people in total through a Northern District of Ohio indictment that also covers ten China-based defendants who remain at large and two individuals whose names are sealed. Investigators seized about 187 laptops and keyboard-video-mouse devices, which let operators control multiple computers remotely from one location, during searches of more than 40 suspected laptop farms across Texas. The State Department is offering rewards of up to $5 million for information that leads to the disruption of the networks.

Northern District of Texas United States Attorney Ryan Raybould said in a statement:

“This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability.”

The scheme, which ran from roughly 2019 until about July 2025 according to the Ohio indictment, involved facilitators who hosted company-issued laptops in the United States so that North Korean workers based overseas could appear to be operating from domestic addresses. In the Ohio case, Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas, were arrested.

Source link