The Justice Department says North Korean hackers have infiltrated dozens of U.S. companies by using American facilitators, fake identities, and sprawling “laptop farms” to mask where the work is really coming from. In a sweeping enforcement action announced Tuesday, federal prosecutors said they have indicted and arrested at least two people, seized more than 180 computers, and searched over 40 residences in Texas linked to the scheme.
How the North Korean remote worker scheme operates
According to the DOJ, the operation depended on North Korean hackers posing as legitimate remote IT workers and getting hired by U.S. companies under stolen identities. Once inside, they could access sensitive systems, steal data, and in some cases extort victims for more money.
The department said American companies had shipped work computers to what they believed were newly hired employees, not realizing those workers were sanctioned North Korean spies using stolen U.S. identities. Federal authorities later seized the machines from suspected laptop farms, which prosecutors described as locations where computers are used to facilitate remote access and hide the hackers’ true location.
CrowdStrike, which helped the FBI investigate and disrupt the latest wave of activity, said these laptop farms are “vital” to North Korea because they help the regime’s hackers overcome the physical, financial, and legal barriers of not actually being in the United States.
Dozens of homes searched in Texas
The Justice Department said it raided more than 40 laptop farms across Texas, calling it the largest disclosed number of homes and residences used to support North Korean hacking operations. Those properties were owned by at least two American facilitators, according to the announcement.
In total, authorities seized over 180 computers. The DOJ said the equipment was allegedly used by North Koreans to remotely break into American companies and steal sensitive data.
The role of the U.S.-based facilitators is central to the case. Prosecutors said North Korean IT workers are increasingly relying on Americans to carry out tasks that help them get hired, stay hidden, and keep their access to victim networks.
- At least two people have been indicted and arrested.
- More than 40 Texas residences were searched.
- Over 180 computers were seized.
- The DOJ says at least 70 U.S.-based companies were infiltrated.
At least 70 companies were hit across multiple industries
Prosecutors said the hackers are believed to have infiltrated at least 70 U.S.-based companies and generated around $3 million in stolen funds. The DOJ did not name the affected organizations, but said they spanned healthcare, cyber support, retail, communications, and manufacturing.
The companies were located in Ohio and 16 other states, as well as the District of Columbia. The breadth of the targets suggests the campaign was not aimed at a single sector, but at a wide range of employers that rely on remote technical labor.
The Justice Department said the hackers often use realistic-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media personas as cover. Those methods can make the applicants look like ordinary remote workers, especially when companies are hiring quickly or using outsourced recruiting processes.
Why these operations are hard to spot
The FBI and private-sector investigators have spent years warning that North Korean operators increasingly blend into ordinary hiring pipelines. The tactic allows them to earn salaries from Western employers while also stealing proprietary information, source code, or internal access that can later be used for extortion.
In a separate public service announcement, the FBI said there are “thousands” of North Korean state-controlled IT workers working at Western companies. The bureau described them as a significant national security and intellectual property theft insider threat.
That warning reflects a broader problem for employers: unlike external cyberattacks that can be traced to suspicious traffic or malware, insider-style schemes begin with a seemingly normal hiring process. Once an attacker is on payroll, they can operate with the trust and privileges granted to regular staff.
What the Justice Department says is changing
Prosecutors said the latest North Korean IT worker activity shows a shift in tactics. As private-sector detection improves and law enforcement pressure grows, North Korean workers are increasingly turning to recruiting American facilitators to help them keep their schemes alive.
“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,” the Justice Department said.
That language suggests the network is becoming more distributed. Instead of a single person spoofing an identity and collecting a paycheck, the operation may involve multiple layers of recruiters, technical stand-ins, and local helpers who each perform part of the fraud.
A long-running source of revenue for Pyongyang
The remote IT worker scheme is one of several illicit revenue streams the North Korean regime has used to raise money while under international sanctions. Other efforts have included cyberattacks on crypto exchanges and open source developer projects, all tied to funding the country’s nuclear weapons program.
The source material says the regime is thought to have stolen at least $2 billion in cryptocurrency during 2025 alone. Experts on North Korea, however, believe the number of hacked companies and the amount of stolen crypto is likely even higher than what has been publicly reported.
Earlier this year, CrowdStrike said North Korean hackers were behind around half of all documented “hands-on-keyboard” intrusions over the previous year. That term refers to attacks carried out directly by humans rather than automated tools or AI systems.
Why this case matters for U.S. employers
The new DOJ disclosure is a reminder that hiring fraud can quickly turn into a cybersecurity incident. Companies that rely heavily on remote onboarding, contract work, or distributed technical teams may be especially exposed if they do not verify identity, location, and device control carefully.
It also shows how North Korean operations continue to evolve. Rather than only attacking from the outside, the regime’s operators are using job applications, fake professional profiles, and U.S.-based assistants to get inside corporate networks with the help of ordinary business processes.
For companies, the challenge is not just spotting malware or suspicious logins. It is also identifying whether the person on the other end of a video interview, email thread, or onboarding request is truly who they claim to be.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 14, 2026 at 10:31 pm
0 views
