40 Laptop Farms, 70 Victim Companies: The DPRK IT Worker Scheme Ran Through American Living Rooms

TL;DR

• what: On October 14, 2026 the U.S. DoJ charged 14 people, seized about 187 computers and revealed that more than 40 laptop farms across Texas were dismantled in raids from September 21 to 25, 2026, all tied to North Korea's fraudulent remote IT worker scheme.
• impact: More than 70 U.S. companies in health care, communications, cyber support, retail and manufacturing unknowingly employed North Korean operatives, generating about $3 million in revenue that sanctions say funds the DPRK's weapons programs.
• fix: There is no patch: the mitigation is tighter identity verification at hiring, scrutiny of device shipping and replacement requests, and oversight of staffing firm placements, as CrowdStrike and the FBI describe in their findings.
• who: Any organization hiring remote IT staff, especially through staffing firms, and especially in the health care, communications, cyber support, retail and manufacturing sectors named by the DoJ.

Somewhere in Texas, in more than 40 ordinary residences, company-issued laptops sat on shelves and desks, powered on, logged in and doing someone else's job. The employees those laptops belonged to, on paper, were American IT contractors. The people actually typing were North Korean operatives working remotely through access tools, drawing salaries from U.S. employers and sending a share back to the regime in Pyongyang.

On October 14, 2026 the U.S. Department of Justice announced charges against 14 people and the seizure of about 187 computers in its latest move against North Korea's fraudulent remote IT worker scheme, as reported by The Hacker News. Raids conducted between September 21 and 25, 2026 dismantled more than 40 of these laptop farms across Texas. The scheme ran from around 2019 to July 2025, touched more than 70 U.S. companies and generated approximately $3 million in revenue for the IT workers.

Who was charged, and who was not

The indictment, brought in the Northern District of Ohio, charges a mix of U.S. citizens and Chinese nationals with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. Most of the named Chinese defendants are listed in Dandong City or elsewhere in Liaoning, with one in Shenzhen. Only two defendants are in custody: Michael James Bostelle, 31, of Philadelphia, Pennsylvania, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. The rest remain at large.

A third U.S. figure, Trey Michael Nolte, is named in the indictment but not charged. Prosecutors allege Nolte managed Dark Falls LLC, a shell company that claimed to offer software development services but was used to carry out the scheme. That detail matters: a vendor with a plausible name and a plausible service line was enough of a front to sit between victim companies and the regime.

⚠️ The victim list is not niche — The DoJ said victims included health care, communications, cyber support, retail and manufacturing companies in Ohio, Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania, Washington and the District of Columbia. Cyber support firms were on that list.

How the machine worked

The operation, tracked as Famous Chollima, purpledelta and Wagemole, depends on U.S.-based facilitators. They help operatives get hired under fake identities, host the company laptops at their homes, run remote-access tools so overseas workers appear to be domestic employees, and open accounts at U.S. banks and money transfer services to move the payroll. Facilitators take a fee for each piece.

CrowdStrike, which linked apparently unrelated employees to shared laptop-hosting locations, described how operatives steer hardware to farm addresses during onboarding. They file fraudulent police reports claiming a laptop was stolen so a replacement ships to a farm. They rotate residential addresses to obscure the final destination. They claim last-minute relocations to divert devices mid-shipment. And in some cases they land roles through IT staffing firms, letting end-client devices be quietly redirected to farm infrastructure without the staffing firm knowing.

Since at least May 2026, CrowdStrike says, Famous Chollima has been spoofing device hashes, for example making a video capture card appear as a webcam, likely to hide the tooling and evade detection. CrowdStrike summed up the farm's role bluntly: it is a rented U.S. footprint that supplies a physical address, a legal identity and a way to satisfy the know your client checks banks rely on.

The threat is already mutating

In parallel, the FBI issued an alert describing an expanded use of facilitators, including subcontracting entire jobs to foreign nationals in South Asia or West Africa. According to the FBI, North Koreans are increasingly obtaining jobs with Western companies and then hiring freelancers, usually in Pakistan, to complete the work for a fraction of the salary. The employer pays a fake American, the regime keeps the spread, and a third party with no vetting at all touches the code and data.

CrowdStrike's assessment of the takedown — CrowdStrike expects the disruption to slow Famous Chollima only in the areas where farms were shut down and says it is unlikely to have lasting effects. The adversary will almost certainly keep evolving to evade discovery.

The RedEye take

Take the numbers at face value and they look modest: about $3 million across more than 70 employers over six years. That framing misses the point. This is not primarily a payroll fraud story. It is a story about a sanctioned nation-state holding legitimate, credentialed, insider access inside American companies, including cyber support providers, for years, and doing it through the most trusted processes a business runs: hiring, onboarding and IT asset logistics.

Arrests are welcome, but two people in custody and a dozen defendants out of reach in China is not deterrence. CrowdStrike is right that the effect will be local and temporary. The durable control point is not law enforcement. It is the employer. Every company that hired one of these operatives had a recruiter, an HR team, an IT team that shipped a laptop and a finance team that paid a bank account. Each of those was a checkpoint, and the scheme passed through all of them. Organizations should treat remote hiring as an access-granting event with the same seriousness as issuing a privileged credential, because that is exactly what it is.

What defenders should learn

• Device logistics is a security signal. A stolen-laptop report followed by a request to ship the replacement to a new address, or a relocation claim during shipping, matches the exact diversion pattern CrowdStrike documented. These events belong in front of security, not only the help desk.
• Staffing firms extend your attack surface. CrowdStrike found end-client devices redirected through staffing firm placements without the firm's knowledge. Contracted workers deserve the same identity and device assurance as direct hires, and contracts should say who is accountable for it.
• Hardware inventory can lie. Spoofed device hashes that make a capture card look like a webcam mean peripheral lists alone do not prove a human is sitting at the machine. Weight behavioral and network evidence over self-reported hardware identity.
• The person you hired may not be the person doing the work. The FBI's subcontracting finding means even a verified identity can front for an unvetted freelancer abroad. Ongoing verification beats a single check at onboarding.
• Watch for shared infrastructure across unrelated hires. CrowdStrike's breakthrough came from linking apparently unrelated employees to common hosting locations. Patterns across your workforce reveal what a single employee review never will.

Source: The Hacker News, "U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud," October 14, 2026. If you want an outside view of how your hiring, onboarding and device workflows would hold up against this playbook, RedEye Security can run that assessment for you.

Originally published on RedEye Threat Intelligence.