The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme.
The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft.
The following individuals have been charged -
- Sun Sheng Ming, 37, Dandong City, China
- Pei Li Guang, age unknown, Liaoning, China
- Weng Shou Cheng, age unknown, Liaoning, China
- Han Guo Bin, age unknown, Dandong City, China
- Wang Jian Jun, 34, Dandong City, China
- Sheng Zhang Kun, age unknown, Shenzhen, China
- Zhang Wei Ping, age unknown, Dandong City, China
- Zhang Li Ping, age unknown, unknown location
- Yu Yang, 40, age unknown, Dandong City, China
- Jin Long, 35, unknown location
- Michael James Bostelle, 31, Philadelphia, Pennsylvania
- Juan Cecilio Pena Carrillo, 37, San Juan, Texas
The two U.S. nationals, Carrillo and Bostelle, have been arrested, while the rest remain at large. The fraudulent scheme was operational from around 2019 to July 2025. Another key U.S.-based co-conspirator, Trey Michael Nolte, has been named in the indictment but was not charged.
Nolte is alleged to have managed a shell company called Dark Falls LLC that claimed to offer software development services, but was in fact used to perpetrate the criminal scheme. The operation also included the dismantling of more than 40 so-called laptop farms across Texas during raids that were conducted between September 21 and 25, 2026.
"Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation's economic strength to further and fuel their own nefarious agendas," said U.S. Attorney David M. Toepfer for the Northern District of Ohio.
Court documents allege that the defendants colluded to participate in a multi-year fraudulent scheme to land remote IT work to generate illicit revenue for the government of the Democratic People's Republic of Korea (DPRK), in violation of international sanctions and to fund its nuclear weapons and other military programs.
The operation, also tracked as Famous Chollima, purpledelta, and Wagemole, revolves around North Korean IT workers getting hired at American and other companies using fake identities, drawing regular salaries, a chunk of which is funneled back to the regime.
These workers are assisted by facilitators in the U.S. to help them get hired, host company-issued laptops at their residences, and leverage remote-access technology to make overseas workers appear to be legitimate U.S.-based employees.
The U.S. facilitators are also responsible for setting up accounts at U.S. banks and online money transfer services to enable the movement of money paid by U.S. victim companies to the IT workers and other persons located abroad. In return for these services, the facilitators are paid a fee.
In all, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers.
"Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies," the U.S. Department of Justice (DoJ) said.
"Victim businesses were located not only in Ohio, but also across much of the U.S., including in Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania, Washington, and the District of Columbia."
The effort is the latest by the U.S. in a long-running and intensifying campaign that aims to cut off a revenue-generation source and dismantle an evolving cyber threat from North Korea whose scale is likely vast.
Cybersecurity company CrowdStrike, which investigated indicators associated with suspected fake IT workers and identified links between apparently unrelated employees and laptop-hosting locations, said the threat actors have resorted to a variety of techniques to direct employer-provided hardware to laptop farm addresses during the onboarding phase.
The operatives have been observed "filing fraudulent police reports claiming a laptop was stolen to trigger replacement shipments to farm addresses; they rotate through residential addresses to obscure the final destination," it said.
"Others claimed last-minute relocations to divert devices mid-shipment. In some cases, operatives secured roles through IT staffing firms, which allowed end-client devices to be quietly redirected to farm infrastructure without the staffing firm's knowledge."
Since at least May 2026, Famous Chollima is said to have begun spoofing device hashes, for example, mimicking a video capture card to appear as a webcam, likely in an effort to hide their use of these tools and to evade detection.
"The laptop farm and its facilitators serve as a rented U.S. footprint: a physical address, a legal identity, and a mechanism to satisfy 'know your client' regulations, which are part of financial institutions' due diligence requirements," CrowdStrike said.
"This disruption will likely slow Famous Chollima's operations only in the immediate areas where the laptop farms were shut down and is unlikely to create long-lasting effects. The adversary will almost certainly continue to evolve their methods to evade law enforcement discovery and disruption."
An Ever-Evolving Threat
In tandem, the U.S. Federal Bureau of Investigation (FBI) has issued an alert, detailing the operation's expanded use of facilitators, in some cases subcontracting entire jobs to foreign nationals in South Asia or West Africa.
"Increasingly, North Koreans are obtaining jobs with Western companies and then hiring freelancers to complete work assignments for a fraction of the total salary," the FBI said. "ITWs subcontract employment-related remote labor to third-party freelancers, usually in Pakistan, India, Nigeria, or neighboring countries."
The IT workers have also been found hiring South Asian or West African freelancers to assist with applying to jobs and with getting hired. These freelancers are paid to apply manually to as many open positions as possible over a specific timeframe or conduct interviews on their behalf.
In addition, the Pyongyang-backed threat actors are alleged to use facilitators' identities without permission to apply for more jobs than agreed to and target economically vulnerable Americans to offer them facilitator gigs.
"ITWs routinely invent elaborate stories, create fake companies, and produce official documentation to lend credibility to their requests," the FBI pointed out. "Common ITW backstories include claiming to be Chinese or East Asian nationals in need of a temporary U.S. presence or claiming to be Eastern Europeans displaced by the ongoing Russia-Ukraine war."
The FBI said it also identified cases where the threat actors have used threats of physical violence against former managers and their families to demand payments and coerce others to carry out actions that further the scheme, marking a newfound escalation of the threat.
Besides using stolen identities to apply for jobs, the IT workers are known to falsely claim ownership of social media accounts, professional profiles, and online identities belonging to other individuals in the tech sector to lend a veneer of legitimacy to their applications.
"North Korean ITWs attempt to use identities or facilitators with the qualifications to obtain a larger pool of jobs, including positions requiring U.S. government security clearances or unique technical skills," the FBI said. "ITWs target positions with cleared defense contractors and other companies involved in U.S. government contracts. ITWs target active-duty U.S. military members to host laptops."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.