On October 13, the U.S. Department of Justice announced the arrest of two individuals in connection with a scheme that involved facilitating North Korean IT workers securing employment at over 70 U.S. companies, generating approximately $3 million in earnings.
summary
The DOJ’s indictment highlights the involvement of Bostel and Pena, who are specifically charged with multiple counts including conspiracy to commit wire and mail fraud and conspiracy to engage in money laundering. Additional charges for Pena include aggravated identity theft.
In a simultaneous enforcement action, law enforcement officials executed searches across more than 40 residences in Texas, resulting in the confiscation of approximately 187 devices related to a suspected North Korean “laptop farm.”
Details of the Indictment
The indictment outlines a sophisticated operation where overseas workers utilized stolen or falsified identification documents to acquire remote IT positions. Domestic intermediaries coordinated these efforts by supplying necessary equipment, addresses, and bank accounts to facilitate this deception.
Through remote access software, these foreign workers were able to perform their tasks on U.S.-based systems, posing as if they were physically present in the country. The indictment claims that more than 25 American identities were compromised in the process, impacting not only employment practices but also providing misleading information to various federal agencies such as the Department of Homeland Security and the IRS.
In total, the operation is alleged to have yielded more than $3 million in income for the workers involved, alongside an equal amount in losses incurred by affected companies, including legal fees and expenses for network repairs.
Cryptocurrency as a Payment Method
The indictment reveals that participants in this scheme utilized virtual currencies as a means to transfer employment earnings overseas. A recorded conversation on July 8, 2024, indicated that prior to transferring funds, there were discussions regarding the use of spreadsheets to manage financial transfers involving various bank accounts and cryptocurrency.
Earlier reports had indicated that approximately $212,700 in stablecoins linked to payments for North Korean IT workers were forfeited following a federal lawsuit. This ruling, issued by U.S. District Judge Rudolph Contreras, highlighted the government’s tracing of crypto assets linked to these fraudulent activities.
Operation Lone Star: Seizures and Arrests
Between September 21 and September 25, the FBI conducted operations against suspected laptop farms in Texas, culminating in the seizure of around 187 devices used to remotely control computers. This operation was part of a broader initiative known as Operation Lone Star, involving joint efforts among various federal agencies.
U.S. Attorney for the Northern District of Texas, David M. Toepfer, emphasized the importance of vigilance among American businesses in light of these developments.
FBI’s Advisory on Recruitment Tactics
In a warning issued by the FBI on October 13, the agency highlighted the increasing trend of North Korean IT workers recruiting Americans who are economically distressed. These recruits are often asked to perform tasks such as attending job interviews, verifying identities falsely, and maintaining employer-issued computers at home.
The advisory details how operations have evolved, noting that North Korean workers are now distributing equipment across multiple residences to minimize detection risks. Furthermore, some participants have been observed subcontracting work to freelancers based in countries such as Pakistan and Nigeria, facilitating a complex web of deceptive employment practices.
