THE US Department of Justice has charged 14 individuals in a North Korea–linked fraud operation that recruited “remote IT workers” to siphon revenue from American companies. The indictment, filed on 14 October 2026, describes a scheme operational from about 2019 to July 2025 that drew salaries for coerced or falsified staff whose pay was partially redirected back to the DPRK.
DoJ officials said more than 70 US employers were affected, spanning health care, cyber support, retail and manufacturing, with the operation generating around $3 million for the IT workers. In a key raid, authorities dismantled more than 40 laptop farms across Texas between 21–25 September 2026, seizing some 187 computers. Two US nationals, Juan Cecilio Pena Carrillo and Michael James Bostelle, were arrested; several others are still at large.
The operator Dark Falls LLC, a shell outfit, allegedly facilitated the effort, enabling the laptops to be hosted at workers’ homes and supporting the movement of wages through US banks and money-transfer services.
CrowdStrike’s investigation linked the group to the broader operation known as Famous Chollima (also tracked as purpledelta and Wagemole). They reportedly used fake identities to obtain US-based employment, arranged for company-issued laptops to be redirected to farm addresses, and spoofed device hashes to hide activity.
The FBI has issued an alert describing expanding use of facilitators, including subcontracting work to freelancers in South Asia or West Africa, with threats of coercion or violence noted in some cases. The DoJ said victim companies were spread across Ohio and many other states, underscoring a persistent risk that nation-state–backed actors will exploit remote-work arrangements to fund illicit programmes. The disruption is described as slowing but unlikely to stop the threat, which is expected to evolve.