Texas Laptop Farm Raids: 187 Devices Seized, Charges Filed in Ohio

Details as of Oct. 14, 2026. The actions were announced on Oct. 13. Everyone charged is presumed innocent, and the descriptions of the scheme are prosecutors’ allegations.

I keep thinking about how easy this must be. A lot of jobs now are done from home. You never meet the person. You just see them on a video call and then the work shows up. I know people who quietly work for two or three companies at the same time, all from their kitchen table. None of the companies seem to notice they are not getting one full-time worker. If an ordinary person can do that, a North Korean worker can do it too. He just needs a U.S. address for the computer to be shipped to, and someone in that house willing to plug it in.

That is close to what prosecutors describe. The FBI searched more than 40 Texas residences between Sept. 21 and Sept. 25 that were known or suspected to be laptop farms, the Justice Department said. A laptop farm is a home where company laptops are kept running for workers overseas. Agents seized 187 laptops and remote-control devices. Separately, an Ohio indictment charged 14 people, and two men were arrested.

The Texas searches and the Ohio indictment

The Texas searches were called Operation Lonestar Roundup. U.S. Attorney Ryan Raybould of the Northern District of Texas and R. Joseph Rothrock, the FBI’s special agent in charge in Dallas, announced them. According to the Texas release, about 100 of the devices came from North Texas. It gives no location for the rest. The seized equipment included laptops and KVM devices, short for keyboard, video, mouse, which let a person at one keyboard and screen run a computer somewhere else. The release says the investigation is ongoing.

The Ohio charges come from a four-count indictment unsealed in the Northern District of Ohio. It charges 14 people with wire fraud, money laundering and identity theft, covering 2019 to about July 2025. Two of them are U.S. nationals who were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten defendants are in China, and the names of the other two have not been made public. The department counts more than 70 U.S. employers, in Ohio, 16 other states and Washington, D.C. Prosecutors say the scheme produced about $3 million in revenue, which they believe went to sanctioned entities controlled by North Korea.

The indictment also names Trey Michael Nolte as a co-conspirator. He has not been charged. According to The Record, prosecutors say he ran a shell company that received work laptops from U.S. companies and recruited Bostelle. Reuters reported that Nolte and the defense attorneys for Pena Carrillo and Bostelle could not immediately be reached for comment.

Numbers that need context

The Justice Department’s national release calls the Texas homes “known or suspected” laptop farms. The Texas release says all 187 devices operated as laptop farms for North Korean workers. Those are different claims, and neither release lists addresses.

Rothrock said each laptop seized “potentially represents one company that has hired a DPRK IT worker,” using the abbreviation for North Korea. The Texas searches seized 187 devices, some of them not laptops, and the department has not said how many companies they tie to. The Ohio case, by comparison, covers more than 70 employers.

The Record reported that the department did not respond to questions about whether the arrests were linked to the raids. Nextgov reported that the Texas release did not address the arrests and that CrowdStrike, the security firm that worked with the FBI, said the arrests happened in Ohio. The department’s release lists Bostelle’s home state as Pennsylvania and Pena Carrillo’s as Texas. It does not say where either was arrested.

One hire, from start to finish

To see how a hire works, take a made-up worker named John Jones. He is not a person in the case. Every step below is something prosecutors, the FBI or CrowdStrike have described.

1. John Jones needs an American identity. The Justice Department says North Korean workers got jobs using stolen or fabricated identity documents. Prosecutors say the U.S.-based participants filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of at least 25 identity theft victims, CyberScoop and Reuters reported.
2. A company interviews him on video. An FBI advisory says workers now pay U.S. citizens to appear on camera, join interviews and verify identities, and sometimes hire freelancers to apply and interview for them.
3. The company mails the laptop to an address in the United States. Prosecutors say Pena Carrillo hosted laptops at his home under various names and received about $190,000 from five employers. They say Nolte kept about two dozen company laptops online for overseas workers and installed remote-access software.
4. John Jones works from overseas. According to the Texas release, workers used virtual private networks and proxy services, which hide where a connection comes from, to look as if they were working from inside the United States.
5. The pay moves through accounts opened under false names, prosecutors say. CyberScoop reported that prosecutors say Nolte moved more than $320,000 that way.
6. Equipment can also be redirected. Nextgov, passing along CrowdStrike’s account, reported that workers filed false police reports saying laptops were stolen, so that employers shipped replacements elsewhere. The same account says others claimed a last-minute move, or got hired through staffing firms, a route that let equipment be sent elsewhere without the firms knowing.

Recruits, and an earlier sentencing

The FBI advisory describes who is recruited to host laptops and take interviews. In The Record’s account of the advisory, North Korea targets low-income Americans and people under financial stress, sometimes telling them the workers are Chinese or East Asian nationals who need a temporary U.S. presence, or Eastern Europeans displaced by the war in Ukraine. It says workers also seek identities that could qualify for jobs requiring security clearances and target active-duty military members to host laptops. When caught, the advisory says, some have threatened violence or the leaking of company data, or demanded large payments.

An earlier case shows what a helper can face. Christina Chapman of Litchfield Park, Arizona, pleaded guilty to conspiracy to commit wire fraud, aggravated identity theft and conspiracy to launder money. On July 24, 2025, Judge Randolph Moss in Washington, D.C., sentenced her to 102 months, about 8.5 years, in prison. The Justice Department said her scheme involved 309 U.S. businesses, more than $17 million and 68 stolen identities, and that agents seized more than 90 laptops from her home in October 2023.

Limits of the takedown

CrowdStrike said in its own announcement, as reported by Nextgov and CyberScoop, that the takedown will likely have limited lasting effect. CyberScoop reported that North Korea’s IT workers have adapted in recent months, starting in May, by faking the identification codes of their devices, making video capture cards look like webcams and reusing disguised devices across jobs. The FBI said in its advisory that there are “thousands” of North Korean IT workers at Western companies, TechCrunch reported. Nearly 30 laptop farms in 16 states were raided in 2025, The Record reported.

The FBI recommends checks throughout a worker’s employment, because no single warning sign reliably flags the scheme. The State Department offers rewards of up to $5 million for information that disrupts it. Companies or people with information can report it at ic3.gov.

The people I know who hold two or three remote jobs are not spies. They are just using the fact that the company only checks whether the work shows up. North Korea uses the same fact. According to prosecutors, it adds a fake name and a helper in a U.S. house, and sends the money home.

Editor written. AI used for spelling and grammar only.