The United States Department of Justice has issued an urgent and sweeping warning regarding an evolving cyber threat from the North Korean regime, revealing that state-backed hackers are increasingly relying on American citizens to facilitate the infiltration of U.S. corporations.
In a coordinated enforcement announcement, federal prosecutors disclosed that they have indicted and arrested at least two individuals and executed search warrants across dozens of suspected “laptop farms” located in the state of Texas. According to federal authorities, these domestic networks of computers were utilized by North Korean actors to remotely log into American companies, circumvent geographical and security controls, and covertly siphon off sensitive corporate data and proprietary intellectual property.
Federal investigators reported that they have successfully seized more than 180 computers shipped out by unsuspecting American companies to newly hired remote employees. These firms had no initial reason to believe that their supposed remote workers were actually sanctioned North Korean operatives. To secure employment, the state-sponsored actors systematically utilized the stolen identities of U.S. citizens, seamlessly blending into the hiring pipelines of Western organizations.
The subsequent law enforcement raids targeted over 40 residences and properties functioning as laptop farms across Texas. Officials noted that this represents the largest disclosed concentration of residential properties utilized to facilitate North Korean cyber operations to date, all of which were reportedly owned or managed by at least two primary American facilitators.
Cybersecurity firm CrowdStrike, which actively assisted the Federal Bureau of Investigation in investigating and disrupting these sophisticated operations, explained that these domestic laptop farms serve as a vital lifeline for North Korea. By routing their connections through local U.S. infrastructure, state-sponsored hackers are able to successfully overcome the physical, financial, and legal barriers associated with operating from outside the United States, effectively masking their foreign origins from corporate human resources and IT security teams.
Prosecutors revealed that at least 70 U.S.-based companies have been infiltrated through this scheme, resulting in an estimated $3 million in directly stolen funds. While the Department of Justice withheld the specific names of the victimized organizations to protect ongoing investigations and corporate privacy, they characterized the affected industries as spanning healthcare, cyber support, retail, communications, and manufacturing sectors. The victimized entities are located across Ohio and 16 other states, as well as the District of Columbia.
Law officials emphasized that the tactics employed by the regime are shifting in response to stronger defenses. Increasingly, North Korean IT workers are turning to the recruitment of American facilitators to counter improved private sector detection mechanisms and aggressive law enforcement interventions. These operatives are hiring domestic accomplices to handle a wider variety of logistical tasks, and in some cases, are subcontracting entire employment positions to third-party foreign nationals who operate under false pretenses.
To maintain their cover, North Korean actors routinely deploy sophisticated social engineering tactics. These include the use of highly convincing email addresses, heavily spoofed LinkedIn profiles, and extensive, carefully curated online and social media presences designed to pass rigorous background checks and virtual interviews.
In a separate public service announcement, the FBI warned that thousands of North Korean state-controlled IT workers are currently embedded within Western companies. The bureau cautioned that these individuals pose a significant national security risk and represent a severe insider threat capable of orchestrating massive intellectual property theft and corporate sabotage.
This enforcement action represents the latest wave in a series of arrests, indictments, and targeted disruptions aimed at neutralizing North Korean illicit activities within the United States. The isolated regime has long relied on the remote IT worker scheme as a dependable pipeline to infiltrate U.S. and European enterprises, secure legitimate wages, and subsequently extract sensitive information. In many documented instances, victimized companies are subsequently extorted by the hackers, who threaten to leak stolen proprietary data unless additional financial demands are met.
The remote IT worker operation is just one of several interconnected revenue streams utilized by Pyongyang to generate illicit funds. The regime has aggressively pursued large-scale cryptocurrency exchange hacks and targeted open-source developer projects to bypass international financial sanctions and fund its heavily restricted nuclear weapons program. Intelligence estimates suggest that the regime managed to steal at least $2 billion in cryptocurrency during the previous year alone.
Cybersecurity and North Korea experts believe that the true scale of the infiltration—including the total number of compromised companies and the full volume of stolen cryptocurrency—is likely much higher than official figures suggest.
Earlier this year, CrowdStrike released a separate threat report indicating that North Korean hackers were responsible for approximately half of all documented "hands-on-keyboard" intrusions over the past year. This classification refers specifically to deliberate, human-driven cyberattacks executed by skilled operators rather than automated scripts or artificial intelligence tools, underscoring the persistent and labor-intensive nature of the regime’s ongoing cyber campaigns against Western commercial infrastructure.