Laptop Farms: Threat to Companies and Security
The Rise of ‘Laptop Farms’: How Remote Work Became a Conduit for international Fraud
Table of Contents
Published August 21, 2025
A New Era of Digital Deception
The shift towards remote work, accelerated by recent global events, has inadvertently opened the door to a elegant and alarming form of digital fraud: “laptop farms.” These aren’t literal farms, but rather networks of computers orchestrated to deceive companies and institutions into believing legitimate employees are working, when in reality, operators – often linked to sanctioned nations like North Korea - are remotely accessing corporate networks.
The scale of this operation is significant. In Arizona, Christina Chapman was sentenced to eight years in prison in 2025 for her role in managing a laptop farm that defrauded over 300 U.S. companies,funneling millions of dollars to the North Korean regime. This case is just the tip of the iceberg, revealing a global industry that’s becoming increasingly difficult to dismantle.
How Laptop Farms Operate: A Step-by-Step breakdown
The mechanics of a laptop farm, while complex in execution, follow a surprisingly linear pattern. It begins with acquiring identities – either fabricated or purchased from unsuspecting individuals. These stolen identities are then bolstered with convincing online profiles: resumes, LinkedIn accounts, project portfolios, and even AI-generated documentation. In some instances, scammers employ deepfake video
technology during online interviews to convincingly impersonate these fabricated candidates.
Onc a remote position is secured, the physical infrastructure of the laptop farm is established – a room filled with computers running remote access software. An intermediary,frequently a U.S. citizen, manages this setup, acting as a bridge between the overseas operators and the victim companies. These computers then simulate the presence of a U.S.-based employee, while the actual work – and malicious activity – is carried out remotely. Paychecks are deposited into dummy bank accounts
and subsequently transferred to north Korea via cryptocurrency platforms and international payment apps.
A Global Threat Expanding Beyond U.S. Borders
This scheme isn’t confined to the United States. Authorities have detected laptop farm activity in europe, South America, Asia, and Australia. High-profile organizations, including Google, Nvidia, Amazon, Nike, and NBC Global, have reportedly been targeted. Sentinelone, a computer security firm, identified over 1,000 applications from 360 identities linked to North Korea alone.
As of June 2025, law enforcement had seized 29 laptop farms across 16 U.S. states, recovering over 200 laptops connected to more than 100 compromised companies.
The role of artificial intelligence in Amplifying the threat
The sophistication of these scams is considerably enhanced by the advanced use of artificial intelligence. AI tools are used