Federal prosecutors have charged 10 people based in China in an alleged North Korean fraud scheme that secured remote technology jobs at more than 70 American companies using stolen identities and concealed overseas connections.
The 14-defendant indictment, announced by the Justice Department on Oct. 13, was filed in the U.S. District Court for the Northern District of Ohio. It describes a network spanning North Korea, China, and the United States, with North Korean IT workers posing as Americans while accomplices helped them pass hiring checks, access corporate computers, and transfer their earnings abroad.
The alleged operation affected businesses in healthcare, communications, technology support, retail, and manufacturing across Ohio, 16 other states, and Washington, D.C.
Two U.S. nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, were arrested. Ten other defendants were identified as based in China, while the identities of two additional defendants remain under seal.
How American Companies Were Deceived
According to the indictment, North Korean technology workers used stolen American identities, fabricated resumes, and falsified documents to obtain remote jobs beginning in 2019.
Related Stories
Once hired, their company-issued laptops were often delivered to accomplices in the United States rather than to the people actually performing the work.
These arrangements, known as “laptop farms,” allowed workers overseas to connect remotely to computers physically located in American homes, making them appear to be working from the United States.
The workers could access corporate systems, while their U.S.-based accomplices collected paychecks and transferred proceeds abroad.
Prosecutors allege that the conspirators compromised more than 25 Americans’ identities, gained unauthorized access to company computer systems, and sent false employment and income information to federal agencies.
The indictment also alleges at least $3 million in losses and related expenses to victim companies, including legal fees and the cost of repairing compromised computer networks.
China-Based Defendants Managed Workers and Payments
Several defendants based in China allegedly supervised overseas workers, coordinated with American accomplices, and handled money generated by the fraudulent employment.
Sun Sheng Ming, who used the online alias “Goldline 1,” lived in Dandong, a Chinese city near the North Korean border. Prosecutors allege that he supervised overseas workers posing as employees and U.S.-based accomplices who facilitated the scheme.
Pei Li Guang and Weng Shou Cheng also allegedly supervised parts of the operation. Weng and Wang Jian Jun, both identified as Chinese citizens, allegedly used bank accounts and money-transfer services to receive and move proceeds.
Another China-based defendant, Jin Long, allegedly supervised overseas workers and American accomplices under the alias “Patrick Bonner.” According to the indictment, he also incorporated a Texas company called B SUCCEED, LLC, to provide employment references for fraudulent job applicants.
The indictment additionally names Han Guo Bin, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, and Yu Yang among the China-based defendants.
The operation also involved shipping American company equipment to China.
In February 2022, U.S.-based accomplice Trey Nolte allegedly shipped two company-issued laptops and chargers to Pei.
In 2023, Nolte allegedly sent Weng several packages containing MacBooks, laptops, an iPhone, and other equipment obtained from American employers that had hired workers using false identities.
The indictment also identifies Dandong, Shenyang, Shenzhen, and Hong Kong as locations where defendants lived or claimed to live while receiving proceeds.
FBI Targets Laptop Farms, Warns of Expanding Threat
Alongside the Ohio prosecution, the Justice Department announced a separate FBI operation in Texas targeting infrastructure used by North Korean remote workers.
Between Sept. 21 and Sept. 25, agents conducted searches and other law enforcement actions at more than 40 residences known or suspected to be operating as laptop farms.
The operation, called “Operation Lonestar Roundup,” resulted in the seizure of approximately 187 laptops and remote-access devices, according to the department.
In a separate Oct. 13 security advisory, the FBI warned that North Korean operatives are expanding their recruitment of American facilitators, sometimes targeting people under financial pressure.
The bureau said Americans have been paid to appear in job interviews, verify false identities, host company laptops, provide access to professional networking accounts, and even complete employment-related fingerprinting or drug tests.
Some North Korean workers have also begun subcontracting entire remote jobs to freelancers in countries including India, Pakistan, and Nigeria, while retaining part of the salaries, according to the FBI.
The advisory warned of more aggressive tactics beyond employment fraud, including attempts to steal company data and extort employers.
The FBI said North Korean operatives have threatened former managers and their families with violence after losing their jobs. Others have threatened to release confidential corporate information unless companies made additional payments.
