DOJ indicts US facilitators behind laptop farms that placed North Koreans inside 70 companies

The U.S. Department of Justice has indicted and arrested at least two Americans accused of operating dozens of "laptop farms" in Texas that allowed North Korean operatives to pose as remote employees of U.S. companies, according to TechCrunch.

Federal agents searched more than 40 locations across Texas — described by the DOJ as the largest number of residences tied to this type of operation ever disclosed — and seized over 180 laptops. Prosecutors believe American employers had shipped those machines to people they thought were new hires, not realizing the recipients were sanctioned North Korean operatives working under identities stolen from U.S. citizens.

The scale of the compromise

The DOJ says at least 70 U.S.-based companies were infiltrated through the scheme, generating approximately $3 million in stolen funds. The victims were not named, but prosecutors described them as operating in healthcare, cyber support, retail, communications and manufacturing, spread across Ohio, 16 other states and the District of Columbia.

CrowdStrike, which worked with the FBI to investigate and disrupt the operation, called the laptop farms "vital" to North Korea because they solve the physical, financial and legal problems created by operatives not actually living in the United States. The hardware sits at a facilitator's address while the worker connects in from abroad, defeating the basic assumption that a company-issued device shipped to a home address is being used by the person who was actually hired.

An evolving playbook

According to the DOJ, North Korean IT workers are increasingly turning to American facilitators to compensate for improved detection by the private sector and mounting law-enforcement pressure. The department said facilitators are being hired for a widening variety of tasks, and that in some cases entire jobs are being subcontracted to third-country nationals.

The cover identities are extensive: realistic email addresses, spoofed LinkedIn profiles and elaborately maintained social-media histories, according to the DOJ.

In a separate public service announcement, the FBI estimated that "thousands" of North Korean state-controlled IT workers are currently embedded at Western companies, describing them as a significant insider threat to both national security and intellectual property.

The broader pattern, as TechCrunch reports, runs as follows: obtain remote employment under a false identity, collect a salary, steal sensitive data and intellectual property from inside the employer's systems, and then extort the victim company for further payment. The proceeds feed a portfolio of illicit revenue streams — including cryptocurrency exchange hacks and operations against open-source developer projects — that fund the country's internationally sanctioned nuclear weapons program. The regime is believed to have stolen at least $2 billion in cryptocurrency during 2025 alone.

Experts on North Korea told TechCrunch that the real number of affected companies, and the true amount stolen, are likely well above the official figures. Separately, CrowdStrike reported earlier this year that North Korean actors were behind roughly half of all documented hands-on-keyboard intrusions over the past year — attacks carried out manually by humans rather than by automated tooling or AI.

Why it matters

This is not a vulnerability in a product; it is a vulnerability in hiring. Remote onboarding made it routine to mail a fully provisioned laptop to someone the employer had never met, and the DOJ's numbers show how far that trust can be stretched — dozens of companies, millions of dollars, and company hardware physically staged inside the country by complicit intermediaries.

For security and engineering leaders, the practical takeaway is that identity assurance is now a first-line control: rigorous verification for remote candidates, scrutiny of where company devices actually sit and who is using them, and monitoring for sessions that route through a single residential connection while the supposed employee claims to be elsewhere. The enforcement action also signals that facilitators inside the U.S. face prosecution, which may deter some intermediaries — but as the DOJ itself notes, the scheme is adapting rather than stopping.