US investigators have arrested two Americans and seized 187 laptops in a fresh crackdown on the laptop farms that hide the true location of North Korean IT workers.
Agents raided 40 locations across Texas. The suspects, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, are accused of helping North Korean workers win remote jobs at US companies under false identities.
A four-count indictment describes a multi-year scheme. The laptop farms matter because they let an overseas operator appear to be logging in from a US address, which defeats the location checks employers rely on during hiring and onboarding.
The operation is part of a broader push that also produced charges against 14 people tied to a sprawling North Korean remote-work network. SecurityWeek reported that the scheme funneled wages back to Pyongyang, which uses the revenue to fund its weapons programs.
The threat is not purely financial. Once inside a company, these workers often keep long-term access to source code, internal systems, and credentials, and researchers have tied some of the same identity-fraud infrastructure to extortion and data theft against employers.
For defenders, the practical lesson is to harden hiring verification and treat remote contractors as a supply-chain risk. Device fingerprinting, in-person or video identity checks, and monitoring for logins that jump between geographic regions can all surface a disguised worker. Companies should also review contractor accounts for the broad access that makes them useful once a fake employee is inside.
