DOJ Dismantles Texas 'Laptop Farm' Network Behind $3 Million North Korean IT Worker Scheme

DOJ Takes Down Texas Laptop Farms Tied to $3 Million North Korean Revenue Stream

The Justice Department announced a coordinated crackdown on October 13, 2026, charging 14 people and dismantling a network of "laptop farms" across Texas that helped North Korean operatives pose as remote IT workers at more than 70 U.S. companies, collecting roughly $3 million in wages that flowed back to the North Korean regime. The FBI conducted searches at more than 40 residences in Texas between September 21 and September 25, 2026, seizing approximately 187 laptops and other devices used to run the scheme.

Incident Details

How the Scheme Worked

The indictment describes a now-familiar pattern for North Korean revenue-generation operations, but at meaningful scale: operatives used stolen or fabricated U.S. identities to apply for and land remote IT jobs at American companies. To make it look like the work was being performed from inside the United States, co-conspirators ran "laptop farms" — residences, often rented specifically for this purpose, where company-issued laptops were kept physically plugged in and remotely accessed by the actual overseas workers using tools like KVM switches and remote-access software.

U.S.-based facilitators, including the two men arrested, allegedly handled the logistics layer: receiving laptops shipped by unwitting employers, keeping the devices online and accessible, and laundering the paychecks earned by the IT workers back toward North Korea. Prosecutors say large parts of the indictment center on Trey Michael Nolte, a U.S. national who allegedly ran a shell company facilitating the scheme, communicated with Chinese and North Korean nationals, recruited Bostelle, shipped packages to China, received employer-issued laptops, and laundered the resulting paychecks. Nolte was not charged, and the DOJ has not explained why.

Official Statements

Ryan Raybould, U.S. Attorney for the Northern District of Texas, framed the action in terms of its disruption to North Korean state revenue: "This investigation is about far more than fraud. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability."

John A. Eisenberg, Assistant Attorney General for National Security, echoed the national-security framing: "North Korea's rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies."

CrowdStrike, which assisted the FBI's investigation, said laptop farms are "vital" infrastructure for North Korea, letting Pyongyang-linked operators get around the physical, financial, and legal barriers of not actually being present in the United States.

Why It Matters

This operation is the latest in a string of DOJ actions against North Korean remote-worker fraud, following a July 2025 case that sent a single laptop farmer to prison for over 8 years in connection with a $17 million scheme. Earlier DOJ estimates put the cumulative cost of these schemes to U.S. businesses at roughly $88 million over six years — and that is likely an undercount, since many victim companies never realize they unknowingly hired a North Korean operative using a stolen identity.

For employers, the case underscores that identity verification for remote hires has become a national-security-relevant control, not just an HR formality. The breadth of affected sectors — healthcare, communications, manufacturing, retail, and cyber support firms among them — shows the scheme wasn't targeting any one industry; it exploited the broad shift to distributed, remote-first hiring across the U.S. economy.

Recommendations

For HR and Hiring Teams

• Require live, verified video interviews before extending remote offers, and be alert to repeated excuses for keeping cameras off.
• Scrutinize requests to ship company laptops to addresses that don't match the employee's stated location, or to residential addresses used by multiple "different" new hires.
• Cross-check identity documents against independent verification services rather than accepting self-submitted scans alone.

For IT and Security Teams

• Monitor for persistent remote-access tooling (KVM-over-IP devices, remote desktop software) running on company-issued endpoints outside of approved support use cases.
• Flag payroll direct-deposit changes routed through multiple intermediary accounts or unusual money-transfer services shortly after onboarding.
• Treat unexplained geolocation mismatches between login activity and an employee's stated residence as an investigation trigger, not just a VPN false positive.

Key Takeaways

1. DOJ charged 14 people and raided 40+ Texas residences in a crackdown on North Korean IT worker "laptop farms" that generated roughly $3 million from 70+ U.S. companies.
2. The scheme ran from 2019 to 2025, using stolen or fabricated identities to place North Korean operatives in remote IT roles while U.S.-based facilitators kept company laptops physically staged and accessible.
3. Two U.S. nationals were arrested on wire fraud, money laundering, and identity theft charges; ten additional defendants based in China were also charged.
4. The case follows a pattern of similar DOJ actions and reinforces that remote-hiring identity verification is now a frontline defense against state-sponsored revenue schemes.

Sources

• Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue — The Record
• DOJ charges 14 over a sprawling North Korean remote work scheme — CyberScoop
• Justice Department says North Koreans have infiltrated dozens of U.S. companies — TechCrunch
• Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Fraud — DOJ Office of Public Affairs