Justice Department says North Koreans have infiltrated dozens of U.S. companies

The Justice Department said Tuesday that North Korean hackers are increasingly using Americans to help them break into U.S. companies, announcing indictments and arrests along with searches at dozens of suspected laptop farms in Texas. Federal authorities seized more than 180 computers that they believe American companies had shipped to newly hired employees, not realizing the workers were sanctioned North Korean spies using stolen identities of U.S. citizens. Prosecutors said they raided over 40 laptop farms across Texas, described as the largest disclosed number of homes and residences used to facilitate North Korean hacks and owned by at least two American facilitators.

At least 70 U.S.-based companies were infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds, according to prosecutors. The DOJ did not name the affected companies but said they operate in the healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia. At least two people were indicted and arrested in connection with the operation.

CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said laptop farms are vital to North Korea because they help its hackers overcome the physical, financial, and legal challenges of not being inside the United States. The Justice Department said North Korean IT workers are increasingly recruiting American facilitators to counter improved private sector detections and law enforcement actions, hiring them for a wider variety of tasks and in some cases subcontracting entire jobs to third-party foreign nationals.

According to the DOJ, North Korean hackers often use real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts to cover their activities. In a separate public service announcement, the FBI said thousands of North Korean state-controlled IT workers are employed at Western companies, calling them a significant national security and intellectual property theft insider threat.

The enforcement action is the latest in a series of arrests, indictments, and actions targeting North Korean activity in the United States in recent years. The regime has used the remote IT workers scheme to place North Koreans in jobs at U.S. and European companies, where they earn a wage and steal sensitive information and intellectual property, after which victim companies are extorted into paying further.

The remote IT workers scheme is one of several strands of illicit revenue for the North Korean regime, alongside hacking crypto exchanges and open source developer projects, with the aim of funding its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025 alone, and experts on North Korea have put the number of hacked companies and the amount of stolen crypto as likely much higher than reported. CrowdStrike said in a separate report earlier this year that North Korean hackers were behind around half of all documented hands-on-keyboard intrusions over the past year, referring to hacks carried out by humans rather than automated tools or AI.

More cybersecurity news from TechManNews.