DOJ Says North Koreans Infiltrated Dozens of U.S. Companies Through Laptop Farms
The Justice Department says North Korean hackers used American facilitators and laptop farms to infiltrate at least 70 U.S. companies, with more than 180 computers seized in Texas and at least two people arrested or indicted.
The DOJ said federal authorities seized over 180 computers that American companies had shipped to newly hired employees, not realizing the workers were sanctioned North Korean spies who had used stolen identities of U.S. citizens to gain employment. Prosecutors said they raided more than 40 laptop farms across Texas, owned by at least two American facilitators.
Prosecutors said at least 70 U.S.-based companies had been infiltrated and that the hackers are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies but described them as operating in healthcare, cyber support, retail, communications and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.
CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said laptop farms are vital to North Korea because they help its hackers overcome the physical, financial and legal challenges of not being in the United States.
“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions,” the Justice Department said. “These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals.” The DOJ also said North Korean hackers often use real-looking email addresses, spoofed LinkedIn profiles and extensive online and social media accounts as cover for their activities.
In a separate public service announcement, the FBI said there are thousands of North Korean-state-controlled IT workers at Western companies. The FBI said they pose a significant national security and intellectual property theft insider threat.
The announcement is the latest wave of arrests, indictments and enforcement actions targeting North Korean activity in the United States in recent years. The regime has used the remote IT workers scheme to place North Koreans in U.S. and European companies, where they earn wages and steal sensitive information and intellectual property. The victim companies are then extorted into paying the hackers further, according to the DOJ.
The remote IT workers scheme is one of several strands of illicit revenue for North Korea, along with hacking crypto exchanges and open-source developer projects, to fund its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025 alone. Experts on North Korea have said the number of hacked companies and the amount of stolen crypto are likely much higher than reported.
Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind around half of all documented hands-on-keyboard intrusions over the past year, referring to hacks carried out by humans rather than automated tools or artificial intelligence.