The FBI has dismantled a network of more than 40 laptop farms in Texas used by North Korean operatives posing as remote IT workers, seizing more than 200 devices, according to The New York Times. The operation was supported by CrowdStrike. No arrests have been made. Authorities chose to disrupt the infrastructure quickly rather than wait for prosecutors to file charges, but warned that people who remain involved in the scheme could face criminal penalties.
The takedown targets a known revenue source for North Korea despite international sanctions. Tom's Hardware reports the scheme is estimated to earn around $500 million a year and affects both startups and Fortune 500 companies. In one incident, Amazon's IT department caught an infiltrator after noticing a 110-millisecond keyboard input lag that suggested the worker was not where they claimed to be.
The Texas operation follows a US crackdown that began last year, when 29 laptop farms across 16 states were shut down. Those farms had helped North Korean IT workers secure jobs at more than 100 US companies. In November 2025, four US citizens and a Ukrainian national were convicted for their roles in similar scams. More recently, the Justice Department unsealed indictments against two US citizens and 10 China-based North Koreans, who prosecutors say defrauded more than $3 million from 70 companies over roughly six years beginning in 2019. The identities of two more individuals remain under seal.
CrowdStrike's Adam Meyers, who leads counter adversary operations, said the scheme is "increasing both in prevalence and complexity." He noted that the company identified an average of two new cases a day last month, but that this was most likely just the tip of the iceberg.
The operation relies on US-based facilitators who host company-issued laptops to make remote workers appear to be in the United States. The FBI's warning indicates those facilitators could face prosecution if they continue assisting the scheme.