The U.S. Justice Department has unveiled a sweeping campaign by North Korean-backed hackers who used Americans as unwitting enablers to penetrate dozens of companies across the country. Prosecutors revealed that working through “laptop farms” in Texas and using stolen identities, these foreign actors embedded themselves in domestic firms to exfiltrate sensitive data and generate illicit profit.
Remote IT workers scheme exposed
Federal law enforcement officials executed raids on over 40 residences in Texas—known as laptop farms—where Americans allegedly assisted hacking operations. These facilitators shipped computers to North Koreans posing as new employees, providing all the hardware needed for U.S.-based intrusion. Agents seized more than 180 computers linked to these operations.
At least one individual has already been arrested, and formal charges have been brought in multiple cases. Investigators believe that at least 70 U.S. companies have already been compromised. These victims span sectors including healthcare, cyber support, retail, communications, and manufacturing across 17 states including Washington D.C. None have been publicly named. Alleged stolen funds so far are in the multimillions range.
How the operation worked—and why it’s dangerous
The DOJ detailed how the hackers used real-seeming, legitimate backdrops—such as spoofed emails, fake LinkedIn profiles, and social media presence—to mask foreign operatives as domestic remote workers. Using stolen U.S. identities, or via subcontracting foreign nationals, these individuals secured job offers from American companies, gaining access to internal systems under the guise of legitimate employment.
Authorities warned this model poses insider risks since the personnel involved are wired into day-to-day operations while collecting sensitive IP or trade secrets for geopolitical adversaries. According to the FBI, thousands of North Korean state-controlled IT workers leveraging Western firms now pose a serious national security and intellectual property threat.
This operation is part of broader tactics used by North Korea—ranging from crypto exchange hacks to open-source project abuse—to generate revenue despite international sanctions. In 2025 alone, the regime is believed to have stolen at least $2 billion in cryptocurrency to fund its nuclear weapons program. Experts believe both the number of compromised companies and volume of illicit activity are undercounted.
This is the most extensive law enforcement disclosure yet involving laptop farm schemes, remote staffing abuse, and identity theft in service of state-sponsored espionage. It follows similar takedowns over the past few years targeting such remote IT worker networks. Authorities say new tactics involve hiring U.S. facilitators to evade detection.
Challenges remain: companies rarely detect such infiltration early, since attackers operate under valid employee credentials and mimic normal communication channels. Law enforcement emphasized the necessity of stronger identity verification, improved internal cybersecurity monitoring, and enhanced public-private coordination to disrupt these operations before they steal secrets.
This case shines a harsh light on how remote IT employment models can be manipulated by foreign adversaries. It underscores the fine line between legitimate remote work and covert espionage. Companies must rethink hiring practices, monitor digital identities, and assume that even inside their network, threats may be watching. What comes next: legal consequences for couriers and facilitators; possible sanctions; plus expanded outreach to defend against identity misuse.
