The U.S. Department of Justice warns that North Korean regime hackers are increasingly enlisting Americans to assist in cyberattacks against U.S. companies.
On Tuesday, prosecutors announced the indictment and arrest of at least two individuals, along with searches of numerous suspected “laptop farms” across Texas. Authorities allege that North Koreans used these computers to remotely infiltrate U.S. firms and exfiltrate sensitive data.
The DOJ reported that federal agents seized more than 180 computers that U.S. companies had sent to newly hired workers, unaware that those employees were sanctioned North Korean operatives using stolen U.S. identities to obtain jobs. Agents also raided over 40 laptop farms in Texas—the highest disclosed count of residences employed to enable North Korean hacking—believed to be controlled by at least two American facilitators.
CrowdStrike, which assisted the FBI in investigating and disrupting the recent North Korean activity, stated that laptop farms are “vital” for enabling North Korean hackers to bypass the physical, financial, and legal obstacles of operating from outside the United States.
Prosecutors allege that at least 70 U.S.-based companies have been compromised by the hackers, who are thought to have netted roughly $3 million in stolen funds. While the DOJ did not disclose the victims’ names, it noted that the affected firms operate in healthcare, cyber support, retail, communications, and manufacturing across Ohio and sixteen additional states, including the District of Columbia.
“North Korean IT workers are increasingly recruiting American facilitators to evade stronger private‑sector defenses and law enforcement measures,” the Justice Department said. “These workers employ facilitators to handle a broader range of tasks and, in some instances, outsource entire projects to third‑party foreign nationals.”
Frequently, North Korean hackers conceal their operations using realistic‑looking email addresses, falsified LinkedIn profiles, and extensive online and social‑media accounts.
In a separate public service announcement, the FBI warned that “thousands” of North Korean‑state‑affiliated IT workers are embedded in Western firms, constituting a serious insider threat to national security and intellectual property.
This represents the most recent surge of arrests, indictments, and enforcement actions aimed at North Korean operations in the United States over the past few years. The regime has exploited its “remote IT workers” scheme to place North Koreans in jobs at U.S. and European firms, where they earn salaries while stealing sensitive data and intellectual property, after which victim companies are often pressured to pay the hackers additional sums.
The remote‑IT‑worker operation is just one facet of the North Korean regime’s illicit revenue streams, which also include hacking cryptocurrency exchanges and open‑source developer projects to finance its sanctioned nuclear weapons program. Authorities estimate that the regime has pilfered at least $2 billion in cryptocurrency during 2025 alone.
Experts on North Korea suggest that both the number of compromised companies and the volume of stolen cryptocurrency are probably far greater than the figures currently disclosed.
Earlier this year, CrowdStrike reported in a separate analysis that North Korean hackers accounted for roughly half of all documented “hands‑on‑keyboard” intrusions over the past year—attacks performed by human operators rather than automated tools or AI.