 |
FILE PHOTO: The US Department of Justice headquarters in Washington, D.C., as authorities investigate an alleged scheme involving North Korean IT workers.
US Arrests Two in North Korean Remote IT Worker Fraud Scheme
WASHINGTON — October 14, 2026
The US Department of Justice has announced the arrests of two American men accused of helping North Korean information technology workers use stolen identities to obtain jobs at US companies. Authorities say the scheme generated millions of dollars for overseas workers linked to North Korea and involved dozens of American businesses.
The arrested men are Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. The Justice Department said both face charges including wire fraud, money laundering and identity theft. The charges are allegations, and the cases will proceed through the US legal system.
As part of the investigation, the FBI searched more than 40 residences in Texas between September 21 and September 25. Investigators seized about 187 laptops and other electronic devices from properties suspected of operating as “laptop farms” for North Korean IT workers, according to the Justice Department.
The indictment also names 10 individuals based in China who were allegedly involved in the operation. According to the department, they include Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang and Jin Long.
The indictment alleges that overseas operators directed Pena and Tey Michael Nolte, along with at least four other Americans, as part of the scheme. Nolte was named in the indictment but was not charged, according to the Justice Department.
Prosecutors allege that Nolte recruited, managed and trained Bostelle and other Americans. The Americans allegedly allowed their names and personal information to be used to make North Korean workers appear to be legitimate employees based in the United States.
The alleged operation involved receiving and hosting laptops belonging to US companies at private residences. This arrangement helped make it appear that overseas workers were carrying out their jobs from within the United States, while the actual work was being directed from abroad.
The Justice Department said the scheme affected more than 70 US companies and compromised the identities of 25 Americans. It also allegedly caused false information to be sent to multiple US government agencies and generated at least $3 million in revenue for the overseas IT workers.
Nolte and lawyers for Pena and Bostelle could not immediately be reached for comment. Emails sent to addresses that the Justice Department said were used by the China-based participants also went unanswered.
US authorities have warned for years that North Korean IT workers seek remote employment at American companies to generate revenue for the North Korean government. Officials have also warned that such schemes can provide opportunities to access company networks and steal data.
The latest arrests and device seizures form part of a broader effort to disrupt these operations. The investigation highlights how stolen identities, remotely managed computers and residential laptop networks can be used to conceal the location of workers seeking employment at US businesses.
