14 Indicted Over North Korean Remote IT Worker Scheme Hitting 70+ US Companies
The US Attorney’s Office for the Northern District of Ohio announced on October 13 that it had unsealed an indictment against 14 defendants accused of helping workers acting for North Korea obtain remote IT jobs at American companies. According to the Justice Department, the scheme ran for several years, affected more than 70 US employers, and generated roughly $3 million that investigators believe was sent on to sanctioned entities controlled by the North Korean government.
Twelve of the defendants are named: ten Chinese nationals, mostly from Dandong and elsewhere in Liaoning province, and two US citizens, Michael James Bostelle of Philadelphia and Juan Cecilio Pena Carrillo of San Juan, Texas. Two further defendants remain under seal. Prosecutors say the two Americans were recently arrested, while the other named defendants are at large. The charges include conspiracy to commit wire fraud, conspiracy to commit money laundering, conspiracy to commit identity theft, and aggravated identity theft.
Under the alleged scheme, US-based facilitators received company-issued laptops at their homes and kept them running so that the overseas workers could log in remotely and appear to be working from inside the United States, a setup commonly called a “laptop farm”. The affected employers span health care, communications, cybersecurity support, retail and manufacturing, and are located in Ohio and in many other states. The FBI’s Cleveland office also issued an alert advising businesses on the risks of hiring remote IT workers.
CyberScoop, which also covered the case, reported that investigators seized about 187 computers in connection with the operation, a detail that did not appear in the Justice Department release itself. The indictment is an allegation, and the defendants are presumed innocent unless proven guilty.