The U.S. Department of Justice has issued a stark warning that state-sponsored hackers operating on behalf of the North Korean regime are increasingly relying on American citizens and domestic facilitators to carry out and sustain cyber intrusions against United States companies.
In a coordinated enforcement announcement, federal prosecutors revealed that they have successfully indicted and arrested at least two individuals and executed search warrants across dozens of suspected "laptop farms" located in Texas. According to federal authorities, these computer setups were exploited by North Korean operatives to remotely hack into American corporations, infiltrate corporate networks, and steal highly sensitive proprietary data and intellectual property.
The ongoing federal operation highlights an evolving and insidious tactic employed by foreign adversaries. Rather than attempting to breach corporate defenses entirely from overseas, North Korean cyber actors are increasingly leveraging local infrastructure and unwitting domestic intermediaries to bypass geographical, physical, financial, and legal barriers that would otherwise hinder their operations from abroad.
As part of the recent sweep, federal authorities seized more than 180 computers. Investigators believe these machines were originally purchased and shipped out by American companies to newly hired remote employees, entirely unaware that the individuals on the other end were sanctioned North Korean spies. These operatives had successfully gained employment by assuming the stolen identities of real U.S. citizens.
The Department of Justice reported that law enforcement agents raided more than 40 residential properties operating as laptop farms across Texas. This represents the largest disclosed number of homes and residences utilized to facilitate North Korean hacking campaigns to date, with these operations managed by at least two domestic American facilitators.
Cybersecurity firm CrowdStrike played a critical role in assisting the FBI to investigate and disrupt these latest North Korean operations. According to the firm, laptop farms serve as a vital component for North Korea, effectively masking the true physical location of state-sponsored hackers and allowing them to seamlessly integrate into Western corporate environments while overcoming the financial and logistical challenges of operating from outside the United States.
Federal prosecutors disclosed that at least 70 U.S.-based companies have been successfully infiltrated through this remote worker scheme. These intrusions are believed to have generated roughly $3 million in direct stolen funds for the regime. While the Department of Justice declined to publicly name the affected organizations, it described the victims as spanning critical industries such as healthcare, cyber support, retail, communications, and manufacturing. These impacted entities are spread across Ohio and 16 other states, as well as the District of Columbia.
Law enforcement officials noted that the tactical approach of North Korean IT workers has shifted in response to heightened corporate security measures. As private sector detection capabilities and federal law enforcement actions improve, North Korean operatives are leaning more heavily on recruited American facilitators to counter these defenses. These workers are increasingly hiring local intermediaries to handle a wider variety of domestic tasks, and in some instances, are even subcontracting entire jobs to third-party foreign nationals to maintain their cover and avoid detection.
To secure these remote positions, North Korean hackers frequently employ sophisticated deception techniques. They routinely utilize realistic-looking email addresses, heavily spoofed LinkedIn profiles, and extensive, fabricated online and social media histories to build credible personas that easily bypass initial corporate human resources screenings.
The threat extends far beyond a handful of isolated incidents. In a separate public service announcement, the FBI warned that thousands of North Korean state-controlled IT workers are currently embedded within Western companies. Federal authorities cautioned that these operatives pose a significant national security risk, acting as dangerous insider threats capable of severe intellectual property theft and corporate sabotage.
This recent wave of arrests, indictments, and enforcement actions is part of a broader, multi-year federal campaign targeting illicit North Korean activities within the United States. The isolated regime has systematically utilized the "remote IT worker" scheme to place operatives inside U.S. and European companies. Once hired, these individuals earn regular corporate wages while simultaneously siphoning sensitive corporate information and proprietary technology. In many cases, victim companies that discover the breach are subsequently extorted by the hackers, who demand further financial payments to prevent the public leakage of stolen data.
The remote IT worker infiltration scheme is merely one strand of a diversified, highly lucrative illicit revenue generation network operated by the North Korean regime. The funds generated through these operations are widely believed by intelligence and law enforcement agencies to directly support the country’s internationally sanctioned nuclear weapons program. Alongside corporate infiltration, North Korean state-sponsored threat actors have aggressively targeted global cryptocurrency exchanges and high-profile open-source developer projects. Estimates indicate that the regime successfully stole at least $2 billion in cryptocurrency during 2025 alone.
Cybersecurity and intelligence experts who closely monitor the region suggest that the true scope of the problem is likely much broader than what has been officially reported. They believe the actual number of compromised companies and the total volume of stolen digital assets significantly exceed current estimates.
Earlier this year, a comprehensive threat report published by CrowdStrike indicated that North Korean hackers were responsible for approximately half of all documented "hands-on-keyboard" network intrusions over the preceding year. This distinction refers specifically to sophisticated cyberattacks executed directly by human operators rather than automated tools or artificial intelligence scripts, underscoring the persistent, hands-on nature of the threat facing Western corporate infrastructure.
