The US Justice Department has charged 14 people over a North Korean job scam, announced on Tuesday. North Korean IT workers used stolen names to get remote jobs at more than 70 US firms.
The workers earned about $3 million, which went to North Korean groups under US sanctions, prosecutors believe. The firm works in health, telecoms, cyber support, retail, and manufacturing across 17 states and Washington, DC.
Moreover, two US nationals, from Pennsylvania and Texas, have been arrested. They and 12 others, including 10 people based in China, are charged with wire fraud, money laundering, and identity theft in Ohio.
Two of the defendants have not been named, and the charges are allegations; all defendants are presumed innocent.
From 2019 to around July 2025, the workers used fake or stolen ID papers to apply, the indictment says. Online tools made it look as if they were working from inside the US.
They also paid helpers in the US to run so-called laptop farms. The helpers kept work laptops at home and set them up so the workers could use them from abroad. They then moved the pay to accounts run by North Korea, prosecutors said.
In a separate operation in September, the FBI searched more than 40 homes in Texas suspected of being laptop farms. It seized about 187 laptops and other devices.
“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said John Eisenberg, the assistant attorney general for national security.
The FBI also issued a new warning to companies as North Korean workers are increasingly hiring Americans to help them avoid detection, and some pass whole jobs on to other foreign nationals, it said.
Security firm CrowdStrike, which helped the FBI, tracks the group as ‘Famous Chollima’. North Korean hackers have also built their own AI tools for attacks, and hidden malware in fake software packages aimed at coders.