U.S. Justice Department warns North Korean hackers are using American agents to infiltrate firms

The U.S. Department of Justice warns that hackers working for the North Korean regime are increasingly using Americans to help them infiltrate U.S. companies. Prosecutors announced on Tuesday that they have arrested and indicted at least two people and searched dozens of suspected laptop farms in Texas. Federal authorities seized over 180 computers that companies had shipped to newly hired workers using stolen U.S. identities, who turned out to be sanctioned North Korean spies.

Operations

The DOJ raided more than 40 laptop farms across Texas owned by at least two American facilitators, marking the largest number of such residences disclosed so far. Cybersecurity firm CrowdStrike helped the FBI investigate and disrupt the operation, noting that these laptop farms help North Korean hackers bypass the physical and legal challenges of operating from outside the United States. At least 70 companies across Ohio, the District of Columbia, and 16 other states have been infiltrated, resulting in around $3 million in stolen funds.

Scope

Affected companies belong to the healthcare, cyber support, retail, communications, and manufacturing sectors. The FBI warns that thousands of North Korean state-controlled IT workers are working at Western companies, posing a major insider threat to national security and intellectual property. North Korea uses this remote worker scheme to earn wages, steal sensitive data, and extort victim companies, helping fund its internationally sanctioned nuclear weapons program.

Context

North Korea has long used state-backed cyber operations and illicit remote work schemes to generate revenue despite heavy international sanctions. Security agencies frequently urge employers to conduct thorough background checks and verify remote hires to prevent foreign operatives from gaining internal access to sensitive corporate networks.