Summary
The Department of Justice announced charges on October 13 against two U.S. citizens accused of facilitating a North Korean IT worker placement scheme that penetrated more than 70 American companies and generated at least $3 million for the North Korean government. FBI agents executed search warrants at more than 40 Texas residences in late September and seized approximately 187 laptops and related devices used as remote work infrastructure for DPRK-affiliated workers operating from China.
Timeline
| Date | Event |
|---|---|
| Sep 21–25, 2026 | FBI executes search warrants at 40+ Texas residences; approximately 187 laptops and devices seized. |
| Oct 13, 2026 | DOJ announces charges against Michael James Bostelle (PA) and Juan Cecilio Peña Carrillo (TX) for facilitating DPRK IT worker placement scheme. |
What Happened
China-based operators recruited Michael James Bostelle of Pennsylvania and Juan Cecilio Peña Carrillo of Texas to lend their identities and host work laptops at residential addresses, creating the appearance that remote IT workers were U.S.-based employees. The scheme successfully placed DPRK-affiliated workers inside more than 70 U.S. companies by exploiting 25 American identities. Revenue from the scheme — salaries paid to workers whose true employment was concealed — totaled at least $3 million, which prosecutors allege was directed to the North Korean government.
DPRK IT worker schemes follow a consistent pattern: operatives apply for remote technology positions using fabricated or stolen U.S. identities, route their connections through domestic laptop farms to mask overseas access, and in some cases leverage their privileged position inside target organizations to conduct espionage or stage extortion. The scheme does not rely on technical vulnerability exploitation — it exploits standard remote employment processes and the difficulty companies face verifying the physical location and true identity of remote contractors.
Identity verification at the point of hire is the primary control against this threat. Recommended steps include video identity verification against government-issued documents, company-managed devices shipped directly to verified addresses, monitoring for remote desktop software and KVM-over-IP tools on contractor endpoints, and reviewing authentication logs for access patterns inconsistent with stated time zones.