US Charges 14 in North Korea Remote IT Worker Scheme Targeting More Than 70 Companies

Federal prosecutors have charged 14 people, including 10 Chinese nationals and two Americans, over an alleged North Korea-linked employment fraud scheme that helped North Korean IT workers obtain remote jobs at more than 70 U.S. companies.

The scheme generated at least $3 million for overseas IT workers, with authorities saying the money was believed to have been sent to sanctioned entities controlled by North Korea, according to the U.S. Department of Justice.

A federal grand jury in Ohio returned the indictment on Oct. 1, charging the defendants with conspiracy to commit wire fraud, conspiracy to commit money laundering, conspiracy to commit identity theft, and aggravated identity theft. The indictment was unsealed on Oct. 13.

The 10 defendants based in China are Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. Two additional defendants remain under seal.

Authorities also charged two U.S. citizens: Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas. Both have been arrested and are expected to appear in federal court in Ohio. The other publicly identified defendants remained at large when the Justice Department announced the charges.

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

According to Reuters, prosecutors allege the operation compromised the identities of 25 Americans and caused false information to be submitted to several U.S. government agencies.

An indictment contains allegations and does not establish guilt. Defendants are presumed innocent unless proven guilty in court.

‘Laptop farms’ helped workers appear to be in the United States

Prosecutors say the operation used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to make overseas IT workers appear to be working from within the United States.

U.S.-based facilitators allegedly received company-issued computers at their homes, configured the machines and installed remote-access software so workers outside the country could operate them. The Justice Department refers to such locations as “laptop farms.”

The scheme affected more than 70 companies in industries including health care, communications, cybersecurity support, retail and manufacturing, according to the Justice Department. Victim companies were located in Ohio and at least 16 other states, as well as the District of Columbia.

Authorities said the operation generated approximately $3 million in income for the IT workers. Prosecutors allege U.S.-based facilitators also helped transfer earnings to North Korean-controlled accounts.

Reuters reported that Chinese-based operators allegedly directed Carrillo and other U.S.-based participants in the scheme. The Americans helped make the North Korean workers appear to be legitimate U.S.-based employees by allowing company computers to be hosted at addresses inside the country.

The U.S. government has repeatedly warned that North Korean workers have sought legitimate remote IT positions using false identities as a way to generate revenue for Pyongyang while potentially gaining access to company networks.

FBI seizes 187 devices in Texas crackdown

The Justice Department also announced a related enforcement action targeting suspected laptop farms in Texas.

Between Sept. 21 and Sept. 25, the FBI searched or conducted other enforcement actions at more than 40 residences suspected of hosting computers for North Korean IT workers. Authorities seized approximately 187 laptops and keyboard-video-mouse devices, commonly known as KVM devices, according to the U.S. Attorney’s Office for the Northern District of Texas.

The operation, called Operation Lonestar Roundup, targeted infrastructure allegedly used to obtain remote employment, access U.S. corporate systems and generate money for the North Korean government.

“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter and adapt to improved private sector detections and law enforcement actions,” the Justice Department said in announcing the broader enforcement effort.

Cybersecurity firm CrowdStrike has identified the North Korean IT-worker network and its facilitators as “Famous Chollima,” according to the Justice Department.

The FBI has urged companies hiring remote IT employees to strengthen identity verification and look for irregularities involving applicants’ identities, physical locations, devices and account activity.