North Korean IT workers infiltrated more than 70 US companies, DOJ says
US authorities say North Korean remote IT workers used stolen identities and American laptop farms to infiltrate more than 70 companies.
The U.S. Department of Justice says North Korean remote IT workers used stolen identities and American facilitators to infiltrate more than 70 U.S. companies, while investigators seized about 187 laptops and KVM devices linked to the operation.1
The laptop-farm problem
The coordinated action included an indictment, two arrests and searches at more than 40 suspected laptop farms in Texas. According to the DOJ, facilitators hosted employer-issued computers in US homes, installed remote-access software and helped workers appear to be based in America.1
The alleged scheme generated around $3 million for IT workers between 2019 and July 2025. The affected employers spanned healthcare, communications, cyber support, retail and manufacturing across Ohio, 16 other states and Washington, DC.1
Why the warning matters
The FBI says North Korean IT workers are broadening their use of facilitators, including people asked to take part in interviews, verify identities, ship packages or keep company devices connected to the internet from private homes.2 The agency warns that no single clue reliably identifies this activity, recommending layered identity checks, access controls and monitoring throughout the employment lifecycle.
TechCrunch reports that CrowdStrike helped the FBI investigate the latest operation and has described laptop farms as a way for North Korean hackers to overcome the physical and legal barriers of working overseas.3 The DOJ says the scheme funds the North Korean regime and its weapons programmes, although the allegations in the court documents have not been tested at trial.1
Our opinion
The striking part of this case is how ordinary remote-work infrastructure becomes a liability when employers treat identity verification as a one-off formality. A laptop shipped to a real American address can create a misleading sense of physical presence, while a legitimate-looking online history can obscure who is actually doing the job.
The FBI’s emphasis on layered checks is more useful than a simplistic blacklist. Companies need to examine the whole employment chain — identity, device access, remote-control tools, account behaviour and unusual data movement — while avoiding crude filters that punish legitimate workers. This is a security problem, but it is also a process problem: every hand-off that nobody owns becomes another place for a determined operator to hide.
The FBI has published mitigation guidance for companies and individuals, including advice to report suspected activity through the appropriate law-enforcement channels.2 The DOJ stresses that defendants are presumed innocent unless proven guilty.1
Hero image: a cybersecurity-themed photograph by Sora Shimazaki, provided by Pexels.4