The U.S. Department of Justice has reported identifying an extensive network that, using fake identities, hiring remote workers, and establishing dozens of laptop storage centers on U.S. soil, enabled North Korean operatives to infiltrate at least 70 American companies. In addition to stealing sensitive information, this operation generated millions of dollars in revenue for North Korea.
The U.S. Department of Justice warned that North Korean-linked cyber actors are increasingly using U.S. citizens to penetrate U.S. companies and circumvent security mechanisms.
Federal prosecutors said on Tuesday, October 13 (21 Mehr), that during recent investigations they have arrested and charged at least two people and searched dozens of locations suspected of storing and managing laptops used in North Korean operations in the state of Texas.
These centers, known as "laptop farms," allowed North Korean actors to remotely access computers that ostensibly were located in the United States and in the possession of legitimate company employees.
Discovery of more than 40 laptop farms in Texas
According to the U.S. Department of Justice, federal agents have seized more than 180 computers that apparently companies had sent for their newly hired employees.
However, those companies did not know that the people they had hired were in fact operatives affiliated with North Korea who, using stolen U.S. citizens' identities, had obtained the jobs.
U.S. officials said they identified and searched more than 40 laptop farms across Texas. This is the largest disclosed collection of homes and residences used to support North Korean cyber activities.
Prosecutors said these centers were operated by at least two American individuals who facilitated the activities of North Korean operatives.
CrowdStrike, the cybersecurity company that cooperated with the FBI in recent investigations, emphasizes that laptop farms play a critical role in North Korean operations.
These centers allow cyber actors to overcome geographic, financial, and legal constraints without being physically present in the U.S., and to continue their activities under the cover of ordinary company employees.
Infiltration of at least 70 companies and theft of $3 million
U.S. prosecutors said North Korean actors succeeded in infiltrating at least 70 companies based in the United States and thereby obtained about $3 million in illicit revenue.
The Department of Justice has not released the names of the affected companies, but said the victims operated in various sectors including healthcare, cybersecurity support, retail, communications, and manufacturing.
These companies were based in Ohio and 16 other states as well as the District of Columbia.
U.S. officials said North Korean actors use legitimate-appearing email addresses, fake LinkedIn profiles, and a collection of social media and other internet service accounts to conceal their true identities.
The Department of Justice also warned that North Korean-linked IT employees, in response to increased ability of private companies and law enforcement to detect suspicious activity, have more frequently turned to hiring American intermediaries.
These intermediaries now take on broader responsibilities and, in some cases, all job-related activities are outsourced to foreign third parties.
FBI warning about thousands of infiltrators
In a separate statement, the Federal Bureau of Investigation (FBI) said that thousands of IT personnel under the control of the North Korean government are working in Western companies.
The FBI warned that the presence of these individuals within company structures poses a serious threat to U.S. national security and increases the risk of theft of intellectual property and confidential information.
This operation is part of a broader North Korean program to use remote IT workers; a program that enables the country's nationals to be employed in American and European companies under fake identities and receive pay.
According to U.S. officials, some of these individuals, after gaining access to companies' internal systems, steal sensitive information and intellectual property, and then extort victim companies by threatening to disclose the information.
Funding the nuclear program through cyberattacks
U.S. officials believe that revenue from IT workers with fake identities is only one of the illicit funding channels for the North Korean regime.
Attacks on cryptocurrency exchanges and infiltration of open-source software development projects are other activities that, U.S. officials say, are used to generate income and fund North Korea's nuclear weapons program.
Estimates indicate that actors affiliated with the country stole at least $2 billion in cryptocurrency in 2025 alone.
However, North Korea experts believe the actual number of victim companies and the value of stolen cryptocurrencies is likely much higher than reported figures.
In this context, CrowdStrike in a separate report published earlier this year said North Korean actors were responsible for nearly half of the "hands-on" intrusions recorded last year.
These attacks refer to intrusions conducted directly and interactively by human attackers, not attacks carried out solely with automated tools or artificial intelligence.
All these findings indicate that the North Korean cyber threat is no longer limited to remote intrusion, but hiring seemingly legitimate workers and using physical infrastructure inside the U.S. has also become an important part of these operations.