The key facts

  • The US Justice Department conducted searches at more than 40 'laptop farms' in Texas, seizing over 180 computers and arresting at least two people.
  • According to the DOJ, North Korean hackers infiltrated at least 70 companies in Ohio and 16 other states, stealing about $3 million.
  • The FBI says there are 'thousands' of North Korean IT workers at Western companies; CrowdStrike links the DPRK to roughly half of all documented intrusions over the past year.

Large-scale operation against DPRK 'remote IT workers'

The US Department of Justice announced on Tuesday a new wave of measures against a scheme in which hackers working for the North Korean authorities take remote jobs at American companies. The prosecutors announced charges and the arrest of at least two people, as well as searches at dozens of suspected 'laptop farms' in Texas — computers that North Koreans used to remotely hack American companies and steal confidential data.

More than 180 computers seized

According to the DOJ, federal authorities seized more than 180 computers that companies had sent to their new employees, unaware that they were sanctioned North Korean agents who had used stolen identities of US citizens to get hired. The agency reported searches at more than 40 'laptop farms' in Texas — the largest disclosed number of such facilities, belonging to at least two American intermediaries. CrowdStrike, which assisted the FBI in the investigation, noted that 'laptop farms' are 'vital' for the DPRK, allowing hackers to circumvent the physical, financial, and legal obstacles associated with not being present in the US.

At least 70 companies and $3 million

The prosecutors reported that hackers breached at least 70 American companies and allegedly earned about $3 million in stolen funds. The names of the affected companies were not disclosed; they were described as operating in healthcare, cyber support, retail, telecommunications, and manufacturing in Ohio and 16 other states, including the District of Columbia. 'North Korean IT workers are increasingly hiring American intermediaries in response to improved detection by the private sector and law enforcement. They hire intermediaries for a wider range of tasks, and in some cases pass entire jobs to third-party foreigners,' the Justice Department stated.

FBI: 'thousands' of agents at Western companies

In a separate alert, the FBI reported that 'thousands' of state-controlled North Korean IT workers are employed at Western companies and pose a 'serious threat of national security breaches and intellectual property theft from within.' According to the DOJ, the hackers often use plausible email addresses, fake LinkedIn profiles, and extensive social media accounts as cover.

Context and scale of the scheme

This is another wave of arrests and charges related to DPRK activity in the US. The 'remote IT workers' scheme allows North Koreans to receive salaries from American and European companies, steal confidential information and intellectual property, and then extort additional payments from the affected companies. The scheme is one of several sources of illicit income for the regime, along with hacking cryptocurrency exchanges and open-source projects that fund its sanctioned nuclear program; by estimates, in 2025 alone the regime stole at least $2 billion in cryptocurrency. Experts on North Korea believe the actual number of hacked companies and the volume of stolen cryptocurrency are likely significantly higher than official figures. Earlier this year, CrowdStrike reported that North Korean hackers were behind roughly half of all documented 'hands-on-keyboard' intrusions over the past year — that is, attacks carried out by humans rather than automated tools or AI.