CLEVELAND — This is an official press release from the U.S. Department of Justice (Federal Bureau of Investigation (FBI)), published as received.

CLEVELAND – The U.S. Attorney’s Office for the Northern District of Ohio has announced the unsealing of a 58-page indictment charging U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies. These charges are the result of a year-long investigation. 

A federal grand jury returned an indictment Oct. 1, 2026, charging the following defendants with Wire Fraud Conspiracy, Money Laundering Conspiracy, Conspiracy to Commit Identity Theft, and Aggravated Identity Theft:

  • Sun Sheng Ming, 37, Dandong City, China
  • Pei Li Guang, age unknown, Liaoning, China
  • Weng Shou Cheng, age unknown, Liaoning, China
  • Han Guo Bin, age unknown, Dandong City, China
  • Wang Jian Jun, 34, Dandong City, China
  • Sheng Zhang Kun, age unknown, Shenzhen, China
  • Zhang Wei Ping, age unknown, Dandong City, China
  • Zhang Li Ping, age unknown, unknown location
  • Yu Yang, 40, age unknown, Dandong City, China
  • Jin Long, 35, unknown location
  • Michael James Bostelle, 31, Philadelphia, Pennsylvania
  • Juan Cecilio Pena Carrillo, 37, San Juan, Texas

Carrillo and Bostelle were recently arrested and are expected to make their initial appearances in court in the Northern District of Ohio in the near future. All other defendants in this case remain at large. Two defendants remain under seal.

“Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

“Today’s indictment underscores the pervasive danger targeting America’s businesses and the lengths at which threat actors and criminal networks will engage to undermine U.S. companies and augment nation-state interests,” said FBI Cleveland Special Agent in Charge Joshua DelManzo. “The FBI remains unyielding in its mission to defend not only Ohio businesses and companies across the country, but also to defend the United States against criminal and national security threats and will continue to investigate threats wherever they originate and ensure those responsible are held accountable.”

According to the allegations in the indictment, the defendants conspired to participate in a multi-year fraudulent scheme to obtain remote IT work to generate revenue for the government of the Democratic People’s Republic of Korea (DPRK), which is more commonly referred to as North Korea. 

The scheme was allegedly carried out by facilitators in the United States who assisted others working on behalf of the DPRK to be hired as remote IT workers with U.S. companies. Among the ways used to carry out the scheme, U.S. facilitators received and hosted multiple laptop computers—issued by victim U.S. companies—at their residences in the U.S., referred to as “laptop farms.” 

In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers. The revenue is believed to have been sent to sanctioned entities controlled by the DPRK.

Victim entities included companies serving a broad array of industries and services including health care, communications, cyber support, retail, and manufacturing companies. Victim businesses were located not only in Ohio, but also across much of the U.S. including in Massachusetts, California, New York, New Jersey, Florida, Georgia, Minnesota, Maryland, North Carolina, Illinois, Virginia, Michigan, Texas, Arkansas, Pennsylvania, Washington, and the District of Columbia.

In addition to the unsealing of the indictment, the FBI has issued an alert for the business community regarding the hiring of remote IT workers. Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter and adapt to improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. For more information about the FBI’s alert to U.S. businesses, visit https://www.ic3.gov/PSA/2026/PSA261013 .

The FBI is actively investigating remote IT worker fraud schemes throughout the country, including FBI’s Cleveland Division in the Northern District of Ohio. 

Assistant United States Attorney Duncan T. Brown for the Northern District of Ohio and Trial Attorney Neeraj Gupta of the Criminal Division’s National Security Section are leading the prosecution.

An indictment is only a charge and is not evidence of guilt. Defendants are entitled to a fair trial in which it will be the government’s burden to prove guilt beyond a reasonable doubt.