WASHINGTON – The Federal Bureau of Investigation (FBI) in September disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programmes, US officials said Oct 13.
The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by the US authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.
The Justice Department separately unsealed indictments in Ohio on Oct 13 against two US nationals and 10 China-based North Koreans accused of committing identity theft to earn pay cheques from unwitting US companies that hired them.
Prosecutors said that scheme bilked 70 companies out of more than US$3 million (S$3.84 million) and ran from 2019 to 2025. The identities of two additional defendants remained under seal.
The moves were the latest by the US in an intensifying campaign to try to cut off a stealthy and evolving digital threat from North Korea whose scale is not entirely clear but likely vast.
US intelligence officials in the Biden and second Trump administrations have said the information technology worker scams are a primary method of funding Pyongyang’s weapons programme, alongside thefts of cryptocurrency.
North Korea is deploying “thousands of state-controlled IT workers to infiltrate companies in the United States and allied countries”, Brett Leatherman, the head of the FBI’s cyber division, said in an interview.
“Every one of these jobs is funding a stream for a nuclear and ballistic missiles programme obtained with the stolen identity of an American and the trust of an American employer.”
The bureau worked closely with the US-based cybersecurity firm CrowdStrike to identify and disrupt the network, Leatherman said.
He added that the coordinated actions were an early example of the FBI’s new cyber strategy, which was unveiled in September and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity.
The strategy is part of a broader effort across the Trump administration to work more closely with US companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.
US officials and cybersecurity analysts have said the North Korean IT worker scheme is among the most serious ongoing digital threats facing businesses today and that it remains underappreciated as a risk.
Adam Meyers, who oversees counter-adversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity”.
It is difficult to know how widespread laptop farms are in the US, Meyers said, but noted that CrowdStrike identified an average of two new cases per day throughout September – which is likely only the tip of the iceberg.
For more than two years, US intelligence officials and cybersecurity researchers have warned that North Korea has been using stolen American identities – often acquired from compromised private information, like Social Security numbers, on the dark web – and artificial intelligence tools to get hired for remote IT jobs at companies across the US, Europe and elsewhere.
Experts have said companies ranging from small start-ups to Fortune 500 firms have been victimised.
A crucial aspect of the fraud campaign is support from people in the US who are recruited by North Korea to help bypass corporate security measures that detect fraudulent hires, according to investigators.
Facilitators help enable the fraud by receiving and setting up work laptops at addresses that appear like legitimate residences to corporate human resources teams.
North Korean operators then use software to remotely tunnel into those laptops and work on them, posing as Americans to the companies that hired them.
The appeal for facilitators is simple: Jobs that look like easy cash and, at least at first, might not require much of them. “They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Meyers said.
Leatherman said that the Texas sweep did not include any arrests of facilitators but that the authorities warned them they could face criminal penalties should they continue to assist with remote fraud.
The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges, he said.
Leatherman said the laptop farms often operate like a “mini data centre” for the North Koreans, where one facilitator hosts dozens or even hundreds of laptops used to fill scores of jobs.
A woman in Arizona sentenced in 2025 to more than eight years in prison was accused of hosting dozens of laptops at her home to help North Koreans connect to more than 300 US companies.
The tactics of North Korea’s IT worker army have steadily evolved to evade detection.
That includes increased reliance on artificial intelligence to create fake resumes, videos and photos, and to navigate virtual job interviews, officials said.
The fraudsters are also relying more on sub-contractors in places like Pakistan and Nigeria to further obscure North Korean involvement, Leatherman said.
In an advisory released on Oct 13, the FBI said the North Koreans were paying Americans and other Western accomplices to “perform a growing variety of identity and location obfuscation tasks” that included appearing on camera, participating in job interviews or meetings, verifying fraudulent identities, shipping packages, and even completing urinalysis tests or fingerprint submissions. NYTIMES
This article originally appeared in The New York Times.