The U.S. Department of Justice has issued a warning regarding the increasing reliance of North Korean hackers on American individuals to facilitate cyberattacks against U.S. companies. In a statement released on Tuesday, prosecutors revealed that they have indicted and apprehended at least two individuals and conducted searches at numerous suspected “laptop farms” located in Texas. These computers were reportedly utilized by North Korean operatives to remotely infiltrate American businesses and extract sensitive information.
According to hinews, federal authorities have confiscated over 180 computers, which they believe were shipped by American companies to newly hired employees, unaware that these individuals were sanctioned North Korean agents who had assumed the identities of U.S. citizens to secure employment. The DOJ disclosed that it executed raids at more than 40 laptop farms across Texas, marking the largest known number of residences utilized for facilitating North Korean cyber operations, owned by at least two American accomplices.
CrowdStrike, which assisted the FBI in investigating and disrupting the recent North Korean activities, stated that these laptop farms are “essential” for North Korea, enabling its hackers to navigate the physical, financial, and legal obstacles of not being present in the United States. Prosecutors indicated that at least 70 U.S.-based companies had been compromised by these hackers, who are estimated to have generated approximately $3 million in illicit funds.
The DOJ did not disclose the names of the affected companies but characterized them as belonging to the healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia. “An increasing number of North Korean IT workers are seeking to recruit American facilitators to mitigate enhanced detection efforts by the private sector and law enforcement. These workers are engaging facilitators to perform a broader range of tasks and, in some instances, subcontracting entire jobs to foreign nationals,” the Justice Department noted.
Frequently, North Korean hackers employ realistic email addresses, counterfeit LinkedIn profiles, and extensive online and social media presences to disguise their activities. In a separate public service announcement, the FBI reported that there are “thousands” of North Korean state-controlled IT workers employed at Western companies, posing a significant threat to national security and intellectual property through insider threats.
This recent wave of arrests, indictments, and enforcement actions targeting North Korean activities in the United States marks a continuation of efforts in recent years. The rogue regime has exploited this “remote IT workers” scheme to enable North Koreans to secure jobs with U.S. and European companies, earn salaries, and subsequently steal sensitive information and intellectual property while employed. Victimized companies are then coerced into paying the hackers additional sums.
The remote IT workers’ scheme is one of several avenues through which the North Korean regime seeks to generate illicit revenue, including hacking cryptocurrency exchanges and open-source development projects, with the objective of financing its internationally sanctioned nuclear weapons program. The regime is believed to have pilfered at least $2 billion in cryptocurrency during 2025 alone. Experts monitoring North Korea suggest that the actual number of compromised companies and the total amount of stolen cryptocurrency is likely much greater than reported. Earlier this year, CrowdStrike indicated in a separate report that North Korean hackers were responsible for approximately half of all documented “hands-on-keyboard” intrusions over the past year, referring to hacks executed by humans rather than automated tools or artificial intelligence.
