Justice Department says North Koreans used US hires

Prosecutors say North Korean operatives used stolen identities, fake profiles and Texas laptop farms to access at least 70 US companies.

The U.S. Department of Justice says hackers working for the North Korean regime are increasingly relying on Americans to help them get into U.S. companies. In an announcement on Tuesday, prosecutors said they had indicted and arrested at least two people and searched dozens of suspected “laptop farms” in Texas. Authorities say those computers were used to give North Koreans remote access to American company systems and to steal sensitive data. The case stands out because, according to IT-PUB News, the scheme now goes well beyond straightforward remote hacking.

Dozens of homes became remote access hubs

Federal authorities said they seized more than 180 computers that had allegedly been shipped by U.S. companies to newly hired workers. Those workers were not who they claimed to be, the DOJ said, but sanctioned North Korean spies using stolen identities of U.S. citizens.

The department also said it raided more than 40 laptop farms across Texas. It described that as the largest disclosed number of homes and residences used to support North Korean hacks. According to the announcement, those locations were owned by at least two American facilitators.

CrowdStrike, which helped the FBI investigate and disrupt the latest operation, said these laptop farms are “vital” to North Korea because they help its hackers get around the physical, financial and legal barriers of not being in the United States.

At least 70 US companies were affected

Prosecutors said the hackers infiltrated at least 70 U.S.-based companies and generated about $3 million in stolen funds.

The DOJ did not name the affected businesses. It said they included companies in healthcare, cyber support, retail, communications and manufacturing across Ohio and 16 other states, as well as the District of Columbia.

The agency also said North Korean IT workers are increasingly turning to American recruiters and facilitators as private-sector detection improves and law enforcement pressure grows. In some cases, the department said, they are subcontracting entire jobs to third-party foreign nationals.

Fake profiles and stolen identities helped hide access

The DOJ said North Korean hackers often rely on realistic-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts to make their activity look legitimate.

In a separate public service announcement, the FBI said there are “thousands” of North Korean state-controlled IT workers at Western companies. The bureau described them as a serious insider threat tied to national security and intellectual property theft.

The latest action adds to a series of arrests, indictments and enforcement steps taken in recent years against North Korean operations in the United States. The regime has used the “remote IT workers” scheme to get jobs at U.S. and European companies, earn wages, and then steal sensitive information and intellectual property while posing as employees.

The operation fits North Korea's wider funding push

The DOJ said the remote worker operation is only one part of North Korea’s broader effort to bring in money. Other strands include hacking crypto exchanges and open source developer projects, with the goal of supporting its internationally sanctioned nuclear weapons program.

The source says the regime is believed to have stolen at least $2 billion in crypto during 2025 alone, and that experts on North Korea think the real number of hacked companies and the amount of stolen cryptocurrency are likely higher than what has been publicly reported.

CrowdStrike also said earlier this year that North Korean hackers were behind around half of all documented “hands-on-keyboard” intrusions over the past year. That term refers to attacks carried out directly by people rather than by automated tools or AI.

For U.S. companies, the warning is blunt: a job candidate, contractor or remote worker cannot automatically be assumed to be who they claim to be. For law enforcement and security teams, the case shows how cybercrime, identity theft and fraud can merge into a single operation that is harder to detect and harder to stop.