The U.S. Department of Justice has announced a major enforcement operation targeting a North Korean scheme that allegedly used stolen American identities and U.S.-based facilitators to infiltrate companies across the country.
Federal authorities say they seized more than 180 computers and searched over 40 suspected laptop farms in Texas. These locations allegedly allowed North Korean IT workers to remotely access computers provided by U.S. employers while disguising their true identities and locations.
More Than 70 Companies Allegedly Infiltrated
According to the Justice Department, the operation affected at least 70 U.S.-based companies across sectors including healthcare, retail, manufacturing, communications, and cybersecurity support.
The affected organizations were spread across Ohio and 16 other states, as well as the District of Columbia. Authorities estimate that the scheme generated approximately $3 million in illicit proceeds.
Prosecutors have indicted and arrested at least two people as part of the investigation. The government has not publicly identified the affected companies.
Investigators allege that some employers shipped computers to people they believed were newly hired U.S.-based employees. In reality, North Korean operatives allegedly used stolen American identities to secure the jobs and relied on local facilitators to operate the equipment.
What Are Laptop Farms?
Laptop farms are locations where computers belonging to U.S. companies are physically hosted and operated by domestic facilitators on behalf of remote workers.
This setup allows overseas operatives to make their activity appear to originate inside the United States, helping them overcome geographical, financial, and legal barriers.
Cybersecurity firm CrowdStrike assisted the FBI in investigating and disrupting the operation. The company has described these facilities as an important part of North Korea’s remote IT worker strategy.
Authorities say the facilitators’ role is expanding as businesses and cybersecurity companies improve their ability to detect suspicious hiring activity.
Fake Identities Help Workers Bypass Hiring Checks
North Korean operatives allegedly use convincing email addresses, fabricated or misused LinkedIn profiles, and extensive social media histories to make their identities appear legitimate.
Once hired, workers can earn salaries while potentially gaining access to corporate systems, confidential information, and valuable intellectual property.
The risks go beyond fraudulent employment. According to U.S. authorities, these schemes can also lead to data theft, corporate extortion, and the misuse of legitimate employee access.
In a separate public service announcement, the FBI warned that thousands of North Korean state-controlled IT workers are believed to be employed at Western companies, creating risks involving insider access and intellectual property theft.
A Source of Revenue for North Korea
The remote-worker scheme is one of several activities U.S. authorities and cybersecurity researchers have linked to North Korea’s efforts to generate revenue despite international sanctions.
Other alleged operations include cryptocurrency theft and attacks targeting open-source software projects. The proceeds are believed to help fund the North Korean regime, including its prohibited weapons programs.
North Korean-linked cyber operations have also become a significant concern for technology companies, financial institutions, and cryptocurrency platforms.
CrowdStrike reported earlier this year that North Korean hackers accounted for around half of documented human-operated cyber intrusions over the preceding year. Such attacks involve people actively carrying out operations rather than relying entirely on automated tools.
Companies Face Growing Insider-Threat Risks
The latest enforcement action highlights how traditional cybersecurity defenses may not be enough when a threat actor enters an organization through what appears to be a legitimate hiring process.
Employers may need to strengthen identity verification, investigate inconsistencies in employment histories, monitor unusual access patterns, and establish safeguards for company-issued devices.
The Justice Department’s investigation also illustrates the importance of cooperation between law enforcement and private cybersecurity firms.
As authorities continue targeting North Korea’s remote IT worker networks, businesses face a growing challenge: distinguishing genuine remote employees from operatives who may use legitimate employment to obtain access to sensitive corporate systems.
