DOJ: North Korean operatives have infiltrated dozens of U.S. firms

The U.S. Department of Justice says hackers working for the North Korean regime are increasingly relying on American citizens to help carry out attacks on U.S. companies.

In an announcement made on Tuesday, prosecutors said they had indicted and arrested at least two people and conducted searches at dozens of suspected "laptop farms" across Texas. The computers were allegedly used by North Koreans to remotely break into American firms and steal sensitive data.

Federal authorities seized more than 180 computers. According to investigators, these had been shipped by U.S. companies to their newly hired employees — who were in fact sanctioned North Korean agents hired under the stolen identities of American citizens. More than 40 laptop farms were raided across Texas, the largest disclosed number of homes and residences tied to such a scheme. The farms were owned by at least two American facilitators.

CrowdStrike, which helped the FBI investigate, calls these laptop farms vital to Pyongyang: they let its hackers overcome the physical, financial, and legal obstacles of not actually being in the United States.

Dozens of firms, millions of dollars

Prosecutors say at least 70 U.S. companies were infiltrated, with the stolen sum estimated at around $3 million. The firms were not named, but were described as spanning healthcare, cyber support, retail, communications, and manufacturing across Ohio and 16 other states, including the District of Columbia.

"Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals," the Justice Department said.

For cover, the hackers often use convincing email addresses, spoofed LinkedIn profiles, and elaborate social media accounts.

In a separate advisory, the FBI said "thousands" of North Korean state-controlled IT workers are employed at Western companies, posing a significant national security and intellectual property theft insider threat.

Part of a larger scheme

This is only the latest wave of arrests and indictments aimed at North Korean activity in the U.S. The "remote IT worker" scheme lets North Koreans land jobs at Western firms, earn a wage, and steal data along the way — after which the employers are extorted into paying up.

The scheme is just one of several illicit revenue streams for the regime, alongside hacking crypto exchanges and open-source developer projects, all aimed at funding its internationally sanctioned nuclear weapons program. North Korea is thought to have stolen at least $2 billion in crypto during 2025 alone, and experts believe the true scale of the damage is far higher than reported.

CrowdStrike has previously said North Korean hackers were behind roughly half of all documented hands-on-keyboard intrusions — attacks carried out by humans rather than automated tools or AI.

Source: TechCrunch