US charges and laptop farm searches target North Korean remote IT worker schemes
The Justice Department announced an indictment, two arrests and searches of more than 40 Texas homes in schemes it says placed North Korean IT workers at more than 70 US companies.
On October 13, 2026, the US Department of Justice announced coordinated actions against North Korean remote IT worker schemes. In these schemes, workers from the Democratic People's Republic of Korea (DPRK) use stolen or fabricated identities to get remote jobs at US companies and send their earnings back to the regime.
A four-count indictment in the Northern District of Ohio charges wire fraud, money laundering and identity theft. It names ten China-based defendants and two sealed defendants. Two US nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. The indictment alleges a multi-year fraud scheme by Bostelle, Pena and their co-conspirators to obtain remote IT work with US companies. The DOJ says more than 70 US companies were affected and that the scheme generated approximately $3 million in revenue for the IT workers, which is believed to have been sent to sanctioned entities controlled by the DPRK.
According to the DOJ, the workers used VPNs and proxy infrastructure to appear to be in the US. The DOJ says US-based facilitators in these schemes host company-issued laptops, install remote-access software and transfer earnings to DPRK-controlled accounts. In a separate operation in the Northern District of Texas, the FBI searched more than 40 Texas homes suspected of being laptop farms between September 21 and 25, 2026.
These are allegations. The DOJ states that all defendants are presumed innocent until proven guilty beyond a reasonable doubt.
Why it matters to AML professionals
Payroll payments to remote workers can be a route for sanctioned regimes to earn money. AML professionals at banks and payment firms may see salary deposits that are quickly moved on to other accounts. Employers and their banks both have a role in spotting identity and payment patterns linked to these schemes.
Red flags in this case
- Salary deposits from several different employers into one account or one address
- Payroll funds moved quickly to third-party accounts, money services businesses or overseas accounts
- Customer identity details that do not match their device locations or login patterns
- One residential address linked to many company-issued devices or employees
If this landed in your queue
- Check whether the account holder's identity and address are consistent with the employment payments received
- Map where payroll funds go after they arrive and identify any common onward beneficiaries
- Review published indicators from the FBI and DOJ and screen for matching contact details
- Consider sanctions risk and file a SAR where activity suggests funds may reach DPRK-linked parties
Key terms
- Laptop farm
- A location where company-issued laptops are kept and remotely accessed so that overseas workers appear to be working from the US.
- Facilitator
- A person who helps a scheme operate, for example by hosting equipment or moving money.
Interview angle
How could a bank detect a customer receiving salaries for North Korean IT workers?
Mention multiple payroll sources into one account, rapid onward transfers, identity and location mismatches, and checking against published government indicators.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.