14 charged in North Korean IT scheme linking China and U.S

U.S. prosecutors on Oct. 13 unveiled charges against 14 people accused of using false or stolen identities to secure remote IT jobs at more than 70 American companies and generate revenue for North Korea. The alleged network linked people in China with U.S. helpers who received company laptops and made them available to workers overseas.

The scheme generated about $3 million in IT earnings believed to have reached sanctioned entities controlled by North Korea, the Justice Department said in its announcement. A federal grand jury in the Northern District of Ohio returned the indictment on Oct. 1, with charges involving wire fraud, money laundering and identity theft.

Two U.S. defendants, Michael James Bostelle and Juan Cecilio Pena Carrillo, had been arrested by the time of the announcement. The other defendants remained at large, and the identities of two of the 14 were still sealed. The allegations have not been proved in court.

According to prosecutors, employers sent laptops to U.S. homes, where helpers kept them connected to the internet and enabled remote access. Overseas workers could then use the machines while the companies believed their employees were in the United States. The Justice Department calls these arrangements “laptop farms.”

Ohio resident Trey Michael Nolte allegedly organized the work through DarkFalls LLC and recruited and trained U.S. helpers. They supplied their names, personal information and mailing addresses in return for a share of the earnings. The indictment names Nolte as a co-conspirator but does not charge him.

Prosecutors describe Sun Sheng Ming, a resident of Dandong, China, as a supervisor who directed overseas IT workers and U.S. helpers and controlled accounts receiving the proceeds. In an exchange recounted in the indictment, Sun instructed Nolte to appear for an employer interview while Sun typed the answers.

One California employer, identified only as “Victim Company 1,” hired someone using Bostelle’s identity in January 2023 and sent equipment to his Pennsylvania address, prosecutors allege. The application used a forged driver’s license in Bostelle’s name. Nolte operated the email account used to communicate with the company and configured its computer for remote access by Sun and others.

The indictment also describes shipments of employer-issued computers to China. Nolte allegedly sent two laptops to Pei Li Guang in February 2022 and four MacBooks to Weng Shou Cheng by DHL in April 2023. Pei and Weng are also accused of helping manage workers, equipment or accounts.

Prosecutors say Nolte forged signatures and authorizations to deposit checks payable to fictitious employees into accounts he controlled. He allegedly presented one bank with 12 authorizations for deposits, withdrawals and endorsements under false employee identities.

One set of account records cited in the indictment shows about $158,700 entering a money-transfer account controlled by Nolte between March 2023 and May 2025, including company payroll and transfers from his other accounts. About $132,100 went overseas during the same period, including roughly $131,900 sent to accounts in China controlled by alleged co-conspirators.

Those entries cover one account, not the full path of the roughly $3 million attributed to the scheme. They do not establish that the recipients in China were the North Korean entities the Justice Department identifies as the ultimate beneficiaries, or show where the money went next.

In a separate business advisory issued the same day, the FBI said North Korean IT teams were expanding their use of American helpers, paying them to attend interviews and meetings and provide access to professional networking accounts.

Americans whose identities were stolen were also affected. Prosecutors allege that some IT earnings were reported under their names, feeding false employment and income information into Internal Revenue Service and Social Security Administration records.