Wednesday 14 October 2026
Afternoon Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Justice Department disrupts North Korean 'laptop farm' hacking scheme, arrests US facilitators

FBI warns thousands of North Korean IT workers hold jobs at Western companies using stolen identities

By LineZotpaper
Published
Read Time2 min
Sources2 outlets
The US Justice Department announced coordinated actions on Tuesday against an elaborate North Korean scheme that planted remote IT workers inside American companies, revealing raids on more than 40 'laptop farms' in Texas, the seizure of over 180 computers, and arrests of at least two American facilitators accused of helping sanctioned North Korean hackers infiltrate employers and steal sensitive data.

Federal prosecutors said the crackdown targeted a network that used stolen identities of US citizens to get North Korean operatives hired by American companies as remote workers. The companies unknowingly shipped company computers to the operatives, who are alleged to have used them to access corporate networks and exfiltrate sensitive information.

The Justice Department said searches were conducted across dozens of suspected laptop farms in Texas, residences that CrowdStrike, which assisted the FBI in the investigation, described as "vital" to helping North Korean hackers overcome the physical, financial and legal challenges of operating outside the United States. At least 70 US-based companies were infiltrated, prosecutors said, in sectors including healthcare, cyber support, retail, communications and manufacturing across Ohio and 16 other states plus the District of Columbia. The affected companies were not named.

The hackers are believed to have generated around $3 million in funds through the scheme. In a separate public service announcement, the FBI warned that "thousands" of North Korean state-controlled IT workers are employed at Western companies, posing a significant national security and intellectual property theft insider threat.

"Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions," the Justice Department said. "These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals."

The announcement is the latest in a series of enforcement actions in recent years targeting the remote IT worker scheme, one of several revenue streams the North Korean regime pursues alongside hacks on cryptocurrency exchanges. Prosecutors said the operatives used realistic email addresses, spoofed LinkedIn profiles and extensive social media presences as cover.

§

Analysis

Why This Matters

  • The scheme shows nation-state hackers exploiting remote work to place operatives directly inside Western companies, giving them access to corporate networks, intellectual property and personal data.
  • The alleged involvement of American facilitators expands the threat beyond North Korean operatives and highlights how legitimate workers can be unwitting participants in espionage.
  • With the FBI warning of thousands of such workers, many companies may be unknowingly employing operatives, meaning the full scale of exposure could be larger than the 70 companies identified.

Background

North Korea has long used cyber operations to generate revenue and steal technology, often through state-sponsored hacker groups. The remote IT worker scheme is a known variant in which operatives pose as freelance or remote employees using stolen or fabricated identities, collecting salaries while also exfiltrating data. US authorities have escalated actions against such operations in recent years, often coordinating with private security firms to identify the infrastructure and facilitators that sustain them.

Key Perspectives

Justice Department and FBI: The enforcement action disrupts a significant espionage pipeline, and the department emphasizes that American facilitators now play a central role in sustaining North Korean operations. CrowdStrike and private sector security firms: They frame the laptop farms as critical infrastructure for the scheme and position improved private sector detection as a driving force pushing North Korea to recruit local help. Critics and skeptics: The relatively modest disclosed financial figure of $3 million raises questions about how much of the scheme remains undetected, and the reliance on victim companies to vet remote hires suggests hiring practices, especially identity verification for remote roles, remain a vulnerability that could allow similar operations to persist.

What to Watch

  • Whether the DOJ names affected companies or announces additional arrests of facilitators in other states.
  • Any corporate disclosures in the coming months from companies that discover they hired operatives under the scheme.
  • Signs of similar law enforcement actions in Europe, where the FBI says thousands of North Korean IT workers may also be employed.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe