North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, the FBI said in an updated FBI public service announcement. At the same time, the Justice Department announced charges, two arrests, and the seizure of about 187 computer devices linked to the scheme.
The FBI said these workers use stolen identities, extort victims, and threaten physical violence to demand payments. North Korea’s government receives an estimated 85 to 90 percent of the revenue they generate, money that helps fund its nuclear weapons and other military programs.
How North Korean IT Workers Use American Facilitators
According to the FBI, North Korean IT workers are hiring Americans for a growing list of tasks. These include appearing on camera, sitting for job interviews, verifying fake identities, lending social media or professional networking accounts, shipping packages, completing urinalysis tests or fingerprint submissions, and keeping work laptops online from their homes.
The FBI said some workers deliberately target people under financial stress, looking for those more likely to follow instructions without questions if paid. Taking part in these activities is illegal.
Home setups that host company laptops, known as laptop farms, have helped the workers hide their locations for years. The FBI said they now run more laptop farms with fewer laptops at each to avoid single points of failure. Some also land remote IT jobs and then subcontract the work to freelancers in Pakistan, India, Nigeria, or nearby countries for a fraction of the salary.
Extortion, Threats, and Identity Theft
Identity theft sits at the center of the scheme. Most names and addresses given to employers come from stolen identities, and workers often buy accounts from identity verification providers to check that stolen details will pass background checks.
The FBI said that after being fired, some workers made death threats against former managers and their families to collect more money. Others threatened to leak sensitive corporate data unless paid large lump sums. Some hired U.S.-based facilitators to show up in person at victim companies to intimidate staff.
The workers also target jobs requiring U.S. government security clearances, positions with cleared defense contractors, and active-duty U.S. military members to host laptops.
Justice Department Charges Linked to North Korean IT Workers
In Ohio, a four-count indictment charges a scheme that ran from 2019 to around July 2025. U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested. Ten China-based individuals were also charged, and two more defendants remain under seal.
Prosecutors say the scheme affected more than 70 U.S. employers and generated about $3 million, believed to have gone to sanctioned DPRK-controlled entities. Victims included health care, communications, cyber support, retail, and manufacturing firms across Ohio, 16 other states, and the District of Columbia.
Under Operation Lonestar Roundup, the FBI carried out searches and other actions at more than 40 Texas residences between Sept. 21 and Sept. 25. Agents seized about 187 laptops and KVM devices. Cybersecurity firm CrowdStrike tracks the group as “Famous Chollima.
FBI Cyber Division Assistant Director Brett Leatherman said 14 individuals have been charged and called close coordination with the private sector central to the operation.
What Companies Should Know About North Korean IT Workers
The FBI said no single red flag reliably identifies North Korean IT workers. It recommends an “identity in depth” approach, using layered checks throughout employment. Warning signs include remote desktop tools such as AnyDesk and TeamViewer, KVM over IP devices like TinyPilot and PiKVM, unrelated software on work devices, and frequent changes in bank accounts or addresses.
Using E-Verify, requiring a U.S. passport, and live identity checks can add friction, the FBI said, while relying only on name ban lists may block real applicants.
Individuals who receive threats should call 911. Victims or anyone approached can contact a local FBI field office and file a complaint at http://www.ic3.gov. The State Department has offered rewards of up to $5 million for information that disrupts North Korea’s illicit financial activities.
