The U.S. Department of Justice is warning that hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of U.S. companies.
In an announcement on Tuesday, prosecutors said they have indicted and arrested at least two people, and conducted searches across dozens of suspected “laptop farms” in Texas. The computers were allegedly used by North Koreans to remotely hack into American companies and steal sensitive data.
According to the DOJ, federal authorities seized over 180 computers that they believe American companies had shipped out to their newly hired employees, not realizing that they were sanctioned North Korean spies who had used stolen identities of U.S. citizens to gain employment. The DOJ said that it raided over 40 laptop farms across Texas, the largest disclosed number of homes and residences used for facilitating North Korean hacks, which were owned by at least two American facilitators.
CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said that laptop farms are “vital” to North Korea in helping its hackers overcome physical, financial, and legal challenges of not physically being in the United States.
The prosecutors said at least 70 U.S.-based companies had been infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies, but described them as healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.
“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,” the Justice Department said.
Oftentimes, North Korean hackers use real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts as cover for their activities.
In a separate public service announcement, the FBI said that there are “thousands” of North Korean-state controlled IT workers working at Western companies, which “pose a significant national security and intellectual property theft insider threat.”
This is the latest wave of arrests, indictments, and enforcement action targeting North Korean activities in the United States in recent years. The breakaway regime has used this “remote IT workers” scheme to allow North Koreans to gain employment with U.S. and European companies, earn a wage, and then steal sensitive information and intellectual property while as employees. The victim companies are then extorted into paying the hackers further.
The remote IT workers’ scheme is one of several strands of illicit revenue that the North Korean regime aims to generate, including hacking crypto exchanges and open-source developer projects, with the aim of funding its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025 alone.
Experts on North Korea have put the number of hacked companies and the amount of stolen crypto as likely much higher than reported.
Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind around half of all documented “hands-on-keyboard” intrusions over the past year, referring to hacks that are carried out by humans and not automated tools or AI.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].