DOJ Cracks Down on North Korean Laptop Farms Used to Hack US Companies
- To bypass enhanced law enforcement measures and better private sector detections, North Korean technology professionals are increasingly recruiting American facilitators.
- Federal authorities seized more than 180 computers that U.S.
- CrowdStrike, which assisted the FBI in investigating and disrupting the operations, stated that laptop farms are vital to North Korea.
To bypass enhanced law enforcement measures and better private sector detections, North Korean technology professionals are increasingly recruiting American facilitators. As the U.S. Department of Justice noted in a Tuesday announcement, these workers now rely on facilitators to handle a wider array of duties and occasionally delegate complete assignments to third-party foreign nationals. Federal authorities have indicted and arrested at least two people and conducted searches across dozens of suspected laptop farms in Texas used to remotely hack American companies.
Federal Seizures and Texas Laptop Farm Raids
Federal authorities seized more than 180 computers that U.S. companies had shipped to newly hired employees. The companies did not realize the recipients were sanctioned North Korean spies who used stolen U.S. citizen identities to gain employment. The Justice Department raided over 40 laptop farms across Texas, which the largest disclosed number of residences used to facilitate North Korean hacks. These properties were owned by at least two American facilitators.
CrowdStrike, which assisted the FBI in investigating and disrupting the operations, stated that laptop farms are vital to North Korea. They help hackers overcome the physical, financial, and legal challenges of operating from outside the United States. Hackers frequently use realistic email addresses, spoofed LinkedIn profiles, and extensive social media accounts as cover, according to the Department of Justice.
Corporate Infiltration and Sector Impact
Prosecutors reported that at least 70 U.S.-based companies have been infiltrated by these remote IT workers, generating approximately $3 million in stolen funds. While the Justice Department did not name specific victims, it described the affected industries as healthcare, cyber support, retail, communications, and manufacturing sectors operating across Ohio and 16 other states, alongside the District of Columbia.
In a separate public service announcement, the FBI warned that thousands of North Korean state-controlled IT workers are embedded at Western companies. The agency stated that these workers pose a significant national security and intellectual property theft insider threat. Victim companies are frequently extorted into paying further ransoms after sensitive data and intellectual property are stolen.
Illicit Revenue Streams and Broader Cyber Operations
The remote IT worker scheme represents one of several revenue streams utilized by the North Korean regime to fund its internationally sanctioned nuclear weapons program. Other methods include hacking cryptocurrency exchanges and open-source developer projects. The regime is estimated to have stolen at least $2 billion in cryptocurrency during 2025 alone, though experts suggest the actual figure and number of compromised companies are significantly higher.
Earlier this year, CrowdStrike reported that North Korean hackers were responsible for approximately half of all documented hands-on-keyboard intrusions over the preceding year. This recent enforcement action marks the latest wave of arrests and indictments targeting North Korean illicit activities inside the United States.