# U.S. Charges 14 in North Korean Remote Work Fraud Scheme

*Published October 14, 2026*
*Source: [https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/](https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/)*

## Executive Summary

The U.S. has charged 14 individuals in a North Korean remote work fraud scheme involving stolen identities and fraudulent employment to fund the regime's activities. This operation underscores the ongoing threat to national security and the need for vigilant detection and prevention measures.

## Article

Federal authorities have indicted 14 individuals in a sweeping effort to dismantle a North Korean scheme exploiting remote IT work. The U.S. Department of Justice announced the charges, which include two American citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, accused of using stolen identities to secure remote jobs at over 70 companies, generating approximately $3 million in illicit earnings. The operation involved 'laptop farms' where devices issued by employers were kept online for use by North Korean engineers working abroad. 

In addition to Bostelle and Carrillo, the indictment names ten others in China and accuses another individual, Trey Michael Nolte, of facilitating the scheme by maintaining company laptops and enabling remote access. Prosecutors allege the conspirators filed fraudulent employment documents with U.S. government agencies using information from more than 25 identity theft victims. This elaborate scheme has been linked to funding North Korea's weapons programs, with the Justice Department emphasizing the national security threat posed by these activities. 

Despite multiple indictments since 2024, the scheme has persisted. U.S. and allied governments recently warned of a North Korean hacking group infiltrating job networks to steal sensitive data and cryptocurrency. The FBI released an advisory detailing the scheme's evolution, including the recruitment of financially vulnerable U.S. citizens to pass interviews and keep laptops operating. The conspirators also allegedly hired freelancers in countries like Pakistan and Nigeria to perform tasks under the guise of legitimate work. 

The advisory highlighted sophisticated tactics, such as threats against former managers and the use of stolen data to extort payment. CrowdStrike, aiding law enforcement, noted the group's use of spoofed device identifiers to evade detection. While these operations may not fully eradicate the scheme, they demonstrate law enforcement's commitment to tracking and disrupting such activities. The State Department is offering up to $5 million for information that could further disrupt this network.