North Korea infiltrated 70 U.S. companies with American help
Key takeaways
- North Korean IT workers are increasingly recruiting American facilitators to gain employment and network access at U.S. companies
- Federal authorities seized over 180 computers from laptop farms in Texas used to conduct remote hacks
- The infiltrated companies span healthcare, cyber support, retail, communications, and manufacturing sectors across multiple states
The U.S. In a Tuesday announcement, prosecutors said they have indicted and arrested at least two people and conducted searches across dozens of suspected "laptop farms" in Texas.
The infiltrated companies operate in healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia. Federal authorities seized over 180 computers that they believe American companies had shipped to employees who were actually sanctioned North Korean spies using stolen identities of U.S. citizens.
North Korean hackers are believed to have generated around $3 million in stolen funds from these operations.
North Korean IT workers are increasingly relying on American facilitators to overcome detection and law enforcement action. As the Justice Department stated: "Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals."
The scheme works by having North Koreans use real-looking email addresses, spoofed LinkedIn profiles, and fabricated online accounts to gain employment at American companies.
According to the FBI, there are "thousands" of North Korean-state controlled IT workers working at Western companies, which "pose a significant national security and intellectual property theft insider threat." The FBI provided guidance in 2024 and 2025 recommending that companies verify employment history, require in-person meetings where possible, analyse payment methods, and scrutinise the addresses where work-related equipment is shipped.
This latest enforcement action is part of a broader pattern of North Korean revenue generation schemes. The regime has used remote IT worker placements to allow North Koreans to gain employment, steal sensitive information and intellectual property, and extort victim companies for further payments. The remote IT workers' scheme is one of several illicit revenue strands aimed at funding the regime's internationally sanctioned nuclear weapons programme.
CrowdStrike, which assisted the FBI in investigating and disrupting these operations, noted that laptop farms are vital to North Korea in helping its hackers overcome physical, financial, and legal obstacles to operating from inside the United States.
