Justice Department says North Koreans infiltrated dozens of US firms

The U.S. Department of Justice says hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of U.S. companies, announcing Tuesday that prosecutors have indicted and arrested at least two people and conducted searches across dozens of suspected “laptop farms” in Texas.

Federal authorities seized over 180 computers that American companies had shipped to newly hired employees without realizing the recipients were sanctioned North Korean spies who used stolen identities of U.S. citizens to gain employment, the DOJ said. Investigators raided over 40 laptop farms across Texas — the largest disclosed number of such homes and residences, owned by at least two American facilitators.

CrowdStrike, which helped the FBI investigate and disrupt the operations, said laptop farms are essential to North Korea in overcoming the physical, financial and legal challenges of not being physically present in the United States.

Prosecutors said at least 70 U.S.-based companies had been infiltrated, generating around $3 million in stolen funds. The DOJ did not name the affected companies but described them as spanning healthcare, cyber support, retail, communications and manufacturing across Ohio and 16 other states, including the District of Columbia.

“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,” the Justice Department said.

The hackers often use real-looking email addresses, spoofed LinkedIn profiles and extensive social media accounts as cover, officials said. In a separate public service announcement, the FBI said there are thousands of North Korean state-controlled IT workers at Western companies, posing what it called a significant national security and intellectual-property-theft insider threat.

The scheme lets North Koreans gain employment at U.S. and European companies, earn a wage, and then steal sensitive information and intellectual property as employees — after which victim companies are extorted into paying the hackers further. It’s one of several revenue streams, alongside hacking crypto exchanges and open-source developer projects, that the regime uses to fund its internationally sanctioned nuclear weapons program; it’s thought to have stolen at least $2 billion in crypto during 2025 alone. Experts say the real number of hacked companies and stolen crypto is likely much higher than reported. CrowdStrike said earlier this year that North Korean hackers were behind around half of all documented “hands-on-keyboard” intrusions — hacks carried out by humans rather than automated tools or AI — over the past year.

Why it matters

The shift toward paying Americans to run hacking infrastructure shows North Korea adapting its sanctions-evasion playbook as private-sector detection improves — raising the compliance bar for any company hiring remote IT or engineering talent without rigorous identity verification.