North Korean operatives have infiltrated at least 70 U.S.-based companies by posing as legitimate employees and using stolen American identities, according to the U.S. Department of Justice (DOJ).
In an announcement on October 13, federal prosecutors said authorities had arrested and indicted at least two people and searched more than 40 suspected “laptop farms” across Texas. These facilities allegedly allowed North Korean IT workers to remotely access computers located in the United States, making it appear as though they were working from within the country.
The Justice Department said investigators seized more than 180 computers that American companies had shipped to what they believed were newly hired employees. Authorities allege that the workers were North Korean operatives who obtained jobs using stolen identities belonging to U.S. citizens.
The operation reportedly involved at least two American facilitators who maintained laptop farms in residential properties. These facilities allowed overseas workers to operate company-issued computers remotely while concealing their actual locations.
According to prosecutors, the infiltrated companies operated across several industries, including healthcare, cybersecurity services, retail, communications, and manufacturing. The affected organizations were located in Ohio and 16 other states, including the District of Columbia. Authorities estimate that the scheme generated approximately $3 million in stolen funds.
Cybersecurity company CrowdStrike, which assisted the FBI in investigating and disrupting the operations, said laptop farms play an important role in helping North Korean operatives overcome physical, financial, and legal barriers to working inside the United States.
The Justice Department said North Korean IT workers are increasingly recruiting American facilitators as businesses and law enforcement agencies improve their ability to detect fraudulent remote employees. In some cases, these workers reportedly outsource entire jobs to third-party foreign nationals.
To appear legitimate, the operatives often use convincing email addresses, fabricated LinkedIn profiles, and extensive online and social media accounts. By securing remote employment under false identities, they can earn salaries while potentially gaining access to sensitive corporate information and intellectual property.
The FBI has separately warned that thousands of North Korean state-controlled IT workers are employed at Western companies, creating a significant national security risk and increasing the threat of intellectual property theft from inside organizations.
The scheme is part of a broader effort by North Korea to generate revenue despite international sanctions. Authorities and cybersecurity researchers have repeatedly linked fraudulent IT employment operations to efforts to funnel money back to the North Korean regime. These workers may also steal company data and use it to pressure employers into paying additional money when their identities or activities are discovered.
North Korean cyber operations also target cryptocurrency exchanges, blockchain projects, and open-source software ecosystems. The funds obtained through these activities are believed to help support the country’s sanctioned weapons programs.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The latest enforcement action highlights the risks organizations face when hiring remote employees without sufficiently verifying their identities, employment histories, and physical locations. Security experts have increasingly warned that fraudulent IT workers can exploit legitimate access to company systems, making these operations harder to identify than conventional cyberattacks.
North Korean IT Workers Infiltrate at Least 70 U.S. Companies, DOJ Says
