North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, the FBI said in an updated FBI public service announcement. At the same time, the Justice Department announced charges, two arrests, and the seizure of about 187 computer devices linked to the scheme.
The FBI said these workers use stolen identities, extort victims, and threaten physical violence to demand payments. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, money that helps fund its nuclear weapons and other military programs.
How North Korean IT Workers Use American Facilitators
According to the FBI, North Korean IT workers are hiring Americans for a growing list of tasks. These include appearing on camera, sitting for job interviews, verifying fake identities, lending social media or professional networking accounts, shipping packages, completing urinalysis tests or fingerprint submissions, and keeping work laptops online from their homes.
[caption id="attachment_114769" align="aligncenter" width="600"] Image Source: FBI Cyber Division[/caption]
The FBI said some workers deliberately target people under financial stress, looking for those more likely to follow instructions without questions if paid. Taking part in these activities is illegal.
Home setups that host company laptops, known as laptop farms, have helped the workers hide their locations for years. The FBI said they now run more laptop farms with fewer laptops at each to avoid single points of failure. Some also land remote IT jobs and then subcontract the work to freelancers in Pakistan, India, Nigeria, or nearby countries for a fraction of the salary.
Extortion, Threats, and Identity Theft
Identity theft sits at the center of the scheme. Most names and addresses given to employers come from stolen identities, and workers often buy accounts from identity verification providers to check that stolen details will pass background checks.
The FBI said that after being fired, some workers made death threats against former managers and their families to collect more money. Others threatened to leak sensitive corporate data unless paid large lump sums. Some hired U.S.-based facilitators to show up in person at victim companies to intimidate staff.
The workers also target jobs requiring U.S. government security clearances, positions with cleared defense contractors, and active-duty U.S. military members to host laptops.
Justice Department Charges Linked to North Korean IT Workers
In Ohio, a four-count indictment charges a scheme that ran from 2019 to around July 2025. U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested. Ten China-based individuals were also charged, and two more defendants remain under seal.
Prosecutors say the scheme affected more than 70 U.S. employers and generated about $3 million, believed to have gone to sanctioned DPRK-controlled entities. Victims included health care, communications, cyber support, retail, and manufacturing firms across Ohio, 16 other states, and the District of Columbia.
Under Operation Lonestar Roundup, the FBI carried out searches and other actions at more than 40 Texas residences between Sept. 21 and Sept. 25. Agents seized about 187 laptops and KVM devices. Cybersecurity firm CrowdStrike tracks the group as "Famous Chollima.
FBI Cyber Division Assistant Director Brett Leatherman said 14 individuals have been charged and called close coordination with the private sector central to the operation.
What Companies Should Know About North Korean IT Workers
The FBI said no single red flag reliably identifies North Korean IT workers. It recommends an "identity in depth" approach, using layered checks throughout employment. Warning signs include remote desktop tools such as AnyDesk and TeamViewer, KVM over IP devices like TinyPilot and PiKVM, unrelated software on work devices, and frequent changes in bank accounts or addresses.
Using E-Verify, requiring a U.S. passport, and live identity checks can add friction, the FBI said, while relying only on name ban lists may block real applicants.
Individuals who receive threats should call 911. Victims or anyone approached can contact a local FBI field office and file a complaint at www.ic3.gov. The State Department has offered rewards of up to $5 million for information that disrupts North Korea's illicit financial activities.
The blog Krebs on Security reported on an identity theft service trying to sell scans of licenses and other documents belonging to people in Canada and the United States.
Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”
Pithy as the phrase sounds, it is undeniably true.
Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.
So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?
That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.
These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.
As we wrote on Malwarebytes Labs:
“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”
It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.
And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.
The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.
So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.
Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.
Yes, the person made a mistake—they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security of our email accounts.
Login
