Key takeaways
- The DOJ arrested at least two people and raided over 40 locations in Texas where North Korean hackers operated laptop farms to infiltrate American companies.
- Authorities identified at least 70 U.S. companies across healthcare, retail, communications, and manufacturing sectors that were compromised, with $3 million in stolen funds recovered.
- North Korean operatives used stolen U.S. citizen identities, fake LinkedIn profiles, and spoofed email addresses to gain employment and access company networks for theft and extortion.
- The FBI estimates thousands of North Korean-state controlled IT workers are currently employed at Western companies, with North Korea stealing at least $2 billion in cryptocurrency during 2025.
Federal prosecutors have charged at least two people in connection with a widespread scheme in which North Korean hackers gained employment at American companies by assuming stolen U.S. identities. The Department of Justice announced the charges on Tuesday, marking the latest enforcement action against what officials describe as a coordinated campaign to infiltrate corporate networks across the country.
The Laptop Farm Operation
Authorities raided more than 40 locations across Texas that functioned as “laptop farms,” makeshift operations where computers were used to facilitate remote hacking activity. Federal agents seized over 180 computers that had been shipped to newly hired employees who were later identified as sanctioned North Korean spies operating under false identities. The raids represent the largest disclosed number of homes and residences used to support North Korean hacking operations in the United States.
How the Scheme Worked
The operation relied on American facilitators who helped North Korean operatives overcome significant obstacles to conducting cyberattacks from inside the United States. According to the Justice Department, these facilitators were hired to complete tasks ranging from basic computer setup to managing entire hacking operations on behalf of third-party foreign nationals. CrowdStrike, which assisted the FBI in investigating and disrupting the latest operations, described laptop farms as “vital” to North Korea’s ability to bypass the physical, financial, and legal barriers that would prevent hackers from operating directly in the country.
Facilitators and Recruitment
At least two American facilitators were identified as owning the raided locations in Texas. The Justice Department noted that North Korean IT workers increasingly rely on recruiting Americans to complete a wider variety of tasks, a shift that reflects efforts to counter improved detection by private companies and law enforcement agencies. The facilitators received compensation for their roles in supporting the hacking infrastructure.
Scope of the Infiltration
Prosecutors said at least 70 U.S.-based companies across multiple sectors had been infiltrated by the hackers. The targeted companies operated in healthcare, cyber support, retail, communications, and manufacturing industries. Affected organizations were spread across Ohio and 16 other states, including the District of Columbia. The hackers generated approximately $3 million in stolen funds through their activities, though the actual total may be higher.
Victim Companies and Sectors
While the Justice Department did not name the infiltrated companies, the breadth of sectors targeted reflects the indiscriminate nature of the operation. Healthcare providers, retail operations, and communications firms all fell victim to the scheme. The geographic spread across more than a dozen states suggests a well-coordinated campaign rather than isolated incidents.
Extortion and Secondary Theft
Once North Korean hackers gained access to company networks as employees, they stole sensitive data and intellectual property. Victim companies were then subjected to extortion demands, forced to pay additional ransoms after their initial compromise. This two-stage theft pattern compounds the damage inflicted on target organizations.
Methods and Deception Tactics
North Korean operatives employed sophisticated social engineering techniques to disguise their true identities. They created convincing email addresses, spoofed LinkedIn profiles, and maintained extensive online and social media accounts as cover for their activities. These false digital personas allowed the hackers to apply for legitimate employment and pass preliminary vetting by corporate hiring teams.
The FBI issued a separate public service announcement warning that “thousands” of North Korean-state controlled IT workers are currently employed at Western companies. Federal authorities described these workers as posing a “significant national security and intellectual property theft insider threat” to American organizations.
North Korea’s Broader Revenue Operations
The remote IT workers scheme represents one component of North Korea’s diversified cybercrime infrastructure aimed at generating revenue to fund its nuclear weapons program. The regime has simultaneously targeted cryptocurrency exchanges and open-source developer projects, stealing digital assets to support its sanctions-evasion efforts. During 2025 alone, North Korea is believed to have stolen at least $2 billion in cryptocurrency.
Experts on North Korean activities estimate that both the number of successfully infiltrated companies and the total value of stolen assets are substantially higher than official disclosures suggest. The gap between reported figures and expert assessments indicates that ongoing operations may not yet be detected.
Recent Escalation in Hand-on-Keyboard Attacks
According to a separate CrowdStrike report released earlier this year, North Korean hackers were responsible for approximately half of all documented “hands-on-keyboard” intrusions conducted over the past twelve months. These attacks, which are carried out by human operators rather than automated tools or artificial intelligence, require active monitoring of compromised systems and often involve real-time theft or sabotage. The high percentage of intrusions attributed to North Korea underscores the country’s dominance in this category of cyberattack.
Law Enforcement Response and Challenges
Tuesday’s announcement represents the latest in a series of enforcement actions targeting North Korean hacking activity in recent years. The scale of the Texas laptop farm operation and the number of arrests suggest that federal authorities are intensifying efforts to disrupt the infrastructure supporting remote intrusions. However, the ongoing recruitment of American facilitators indicates that the underlying economic incentive structure remains attractive to potential collaborators.
The use of stolen identities to gain employment, combined with the difficulty of identifying operatives who work remotely, presents persistent investigative challenges. As North Korean operatives adapt their tactics in response to detection improvements, law enforcement and private companies face mounting pressure to develop new countermeasures.
Source: TechCrunch
Frequently Asked Questions
How did North Korean hackers gain access to U.S. companies?
They assumed stolen identities of U.S. citizens to apply for legitimate employment, creating fake LinkedIn profiles and email addresses as cover. Once hired, they used computers from laptop farms in Texas to remotely access company networks.
What industries were targeted in the operation?
The hackers infiltrated companies across healthcare, cyber support, retail, communications, and manufacturing sectors. At least 70 companies were compromised across Ohio and 16 other states, including the District of Columbia.
What does North Korea use the stolen data for?
North Korea uses hacking as a revenue source to fund its nuclear weapons program. In addition to stealing from infiltrated companies and extorting victim organizations, the regime targets cryptocurrency exchanges and open-source projects, stealing at least $2 billion in crypto during 2025.
