US cracks down on North Korean IT worker scams at 70+ US firms; shares email IDs

The US Department of Justice (DOJ) has announced a coordinated crackdown on a North Korean remote IT worker scheme that allegedly infiltrated dozens of American companies using stolen identities, warning businesses about a growing threat that generated millions of dollars for Pyongyang. More than 70 US companies were affected by the operation, according to the department. The action includes criminal charges against multiple suspects, two arrests, searches of dozens of suspected "laptop farms" and the seizure of approximately 187 laptops and related devices used to help North Korean operatives obtain remote jobs at US companies.How the scheme workedAccording to an indictment unsealed in the Northern District of Ohio, North Korean workers got remote jobs at US companies from 2019 to around July 2025. They used stolen or fabricated identity documents, plus VPNs and proxy infrastructure, to appear to be U.S.-based employees.U.S.-based facilitators hosted the laptops that victim companies issued to these “employees” at their homes, the so-called laptop farms. They set up the machines, installed remote-access software and transferred the earnings to accounts controlled by North Korea.The scheme generated about $3 million in revenue, believed to have been sent to sanctioned North Korean entities. Victims included companies in health care, communications, cyber support, retail and manufacturing across Ohio, 16 other states and Washington, D.C.FBI raids laptop farmsAs part of the operation, the FBI executed searches at more than 40 locations in Texas believed to be connected to "laptop farms" used by North Korean workers. Investigators seized approximately 187 laptops and remote-access devices that allegedly enabled the fraud. The DOJ said the activity has been linked to a threat group known as "Famous Chollima," which has previously been associated with North Korean IT worker operationsArrests and chargesTwo US nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested on charges of wire fraud, money laundering and identity theft. The indictment also names 10 China-based defendants, with two more under seal. The FBI said 14 people in total face charges.Texas raidsFrom Sept. 21 to Sept. 25, the FBI searched more than 40 residences in Texas in what it calls Operation Lonestar Roundup. Agents seized about 187 laptops and KVM devices. Cybersecurity firm CrowdStrike identified the group as “Famous Chollima.”“Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs,” said U.S. Attorney Ryan Raybould of the Northern District of Texas.Email IDs made publicThe department published 11 email addresses it says the operatives used and urged employers to add them to their screening indicators:Bright.star.me208@gmail.comMerrttank.bz@gmail.comrandyryang@gmail.commichaelb860102@gmail.comassassinki211@gmail.comdev.jerryyang@gmail.comdenis.turgenev2021@gmail.comyesiree.cano825@gmail.comthomasdenzelbrown@gmail.comanthonyortega4592@gmail.comtyler.j.palmi38@gmail.comChanging tacticsThe FBI issued a public service announcement with guidance for companies. It warns that North Korean workers increasingly recruit American facilitators to get around better detection. They give those facilitators a wider range of tasks and sometimes subcontract whole jobs to third-party foreign nationals. Some have also committed data extortion and stolen sensitive company data.A 2022 advisory said individual North Korean IT workers can earn up to $300,000 a year. The State Department is offering rewards of up to $5 million for information that helps disrupt North Korea’s illicit financial activities.The department noted that the court filings contain allegations, and all defendants are presumed innocent until proven guilty.