Federal authorities have shut down a sophisticated North Korean remote IT worker scheme that infiltrated dozens of American companies, including many in Texas, funneling hundreds of millions of dollars toward Pyongyang’s weapons programs.
The Department of Justice announced the dismantling of the network alongside the arrests of two U.S. nationals: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Both face charges of wire fraud, money laundering, and identity theft. Federal prosecutors also announced indictments against several Chinese nationals connected to the operation.
The scheme, which ran from 2019 through July 2025, allowed North Korean IT operatives to pose as American workers using stolen or fabricated identities. They secured remote employment at companies across the healthcare, communications, retail, cybersecurity, and manufacturing sectors.
FBI Dallas Special Agent in Charge Joseph Rothrock said more than 100 laptops were seized in North Texas alone, with approximately 187 devices recovered from over 70 companies nationwide. In September, federal agents searched more than 40 homes across Texas looking for electronic devices tied to the operation.
Rothrock explained that North Korean state organizations collected between 85 and 90 percent of the wages earned by these fraudulent workers. Those funds were then directed toward ballistic missile development, nuclear programs, and intelligence operations.
The Treasury Department estimated in 2024 that the network generated more than 800 million dollars from unwitting U.S. employers. U.S. Attorney for the Northern District of Texas Ryan Raybould called the national security consequences severe.
Raybould dismissed any claims of ignorance from those who hosted large numbers of laptops in their homes on behalf of the scheme. He said anyone housing 30 to 40 devices and claiming they had no knowledge of wrongdoing was making an argument that held no weight.
Investigators found that North Korean operatives relied on a network of fraudulent email accounts to carry out the fraud. Among the accounts identified were addresses such as randyryang@gmail.com, assassinki211@gmail.com, thomasdenzelbrown@gmail.com and dev.jerryyang@gmail.com. Employers are being urged to flag these addresses as indicators of potential DPRK-linked activity.
The FBI is currently contacting affected companies in the Dallas-Fort Worth area and across the country. Raybould indicated that additional indictments targeting facilitators of the scheme are expected in the near future.