Circuit Wire — a daily news update from the Circuit.
The Justice Department on Tuesday announced charges against 14 people in a North Korean remote IT worker scheme that reached more than 70 US companies. Two Americans were arrested, and agents searched more than 40 homes in Texas.
An indictment unsealed in the Northern District of Ohio charges wire fraud, money laundering and identity theft. Prosecutors say the group earned about $3 million in pay between 2019 and 2025. Victim companies are in Ohio, 16 other states and Washington, DC. Ten of the defendants are based in China, and two names remain under seal.
The two men arrested are Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. CyberScoop reports that Bostelle allegedly supplied his name and a fraudulent driver's license so a remote worker could be hired. Pena Carrillo allegedly kept company laptops at his home and received about $190,000 from five employers. Both men are accused of filing false employment records that used the names of more than 25 identity theft victims.
CyberScoop also describes a third Ohio man, who has not been charged. He allegedly kept about two dozen laptops online for overseas workers and moved more than $320,000 through accounts opened under false names.
The Texas searches, part of Operation Lonestar Roundup, ran from September 21 to 25 and seized about 187 computer devices. The FBI also issued a public service announcement with guidance for employers and listed 11 Gmail accounts tied to the schemes. The State Department is offering rewards of up to $5 million for information on North Korean illicit finance.
The FBI advisory and CrowdStrike describe changing tactics. Workers now pay US citizens to attend job interviews and take drug tests. Since May, some have spoofed device identifiers and made a video capture card appear as a webcam. Some have threatened former managers after being fired, and others have sent people to intimidate companies in person.
CrowdStrike, which tracks the group as Famous Chollima, said that taking down one laptop farm will likely have only a limited effect on the wider operation. Ryan Raybould, the US Attorney for the Northern District of Texas, described the case as "a hostile foreign regime infiltrating American companies through stolen identities."
The court documents contain allegations only, and all defendants are presumed innocent until proven guilty.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.