DOJ Says North Korean IT Workers Infiltrated Over 70 US Companies

The US Department of Justice has warned that North Korean operatives have infiltrated more than 70 American companies, unveiling a sweeping crackdown on the regime's remote IT-worker scheme that includes two arrests and raids on dozens of suspected "laptop farms" in Texas.

In an announcement on Tuesday, prosecutors said the FBI had searched more than 40 residences across Texas between September 21 and September 25 and seized roughly 187 laptops and other devices. The computers had been shipped by American companies to what they believed were newly hired employees — who were, prosecutors allege, sanctioned North Korean spies working under stolen US identities.

The announcement

The DOJ said it had arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas on charges of wire fraud, money laundering and identity theft. A four-count indictment from the Northern District of Ohio also named ten China-based defendants, bringing the total charged to fourteen. The scheme ran from 2019 until around July 2025, prosecutors say, and was directed from China.

"Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions," the Justice Department said.

How the scheme worked

The operation was an elaborate exercise in digital disguise. North Korean IT workers allegedly used stolen or fabricated identity documents, VPNs and proxy infrastructure to appear as US-based employees, applying for remote jobs at American firms with real-looking email addresses, spoofed LinkedIn profiles and extensive fabricated social media histories.

The linchpin was the "laptop farm". Victim companies would ship corporate laptops to the address of their new "employee" — in reality, the home of an American facilitator in Texas. The facilitator would set the machines up on a rack, keep them powered on and connected to the company network, and allow the North Korean operative to work remotely from abroad as if sitting at a US desk.

The scale of the infiltration

The DOJ described the fraud as "massive". At least 70 US-based companies were infiltrated, spanning healthcare, cyber support, retail, communications and manufacturing. The identities of 25 Americans were compromised, false information was sent to multiple US government agencies, and the scheme generated at least $3 million in revenue for the overseas IT workers.

CrowdStrike, which helped the FBI investigate, said laptop farms are "vital" to North Korea, helping its hackers overcome the physical, financial and legal challenges of not being in the United States. In a separate public service announcement, the FBI warned that "thousands" of North Korean state-controlled IT workers are employed at Western companies, posing "a significant national security and intellectual property theft insider threat".

The money trail

Once inside a company, the operatives earned legitimate wages — which were routed back to the regime — and then stole sensitive information and intellectual property as employees. In some cases, prosecutors say, victim companies were then extorted into paying the hackers further to keep stolen data private.

The remote IT-worker scheme is one of several illicit revenue streams North Korea maintains to fund its internationally sanctioned nuclear weapons programme, alongside the hacking of cryptocurrency exchanges. The regime is thought to have stolen at least $2 billion in cryptocurrency during 2025 alone.

Why laptop farms matter now

The Tuesday action is the largest disclosed number of homes and residences used for facilitating North Korean hacks — a sign that the regime is scaling up its reliance on American facilitators precisely as private-sector detection and law enforcement pressure improve. The DOJ's message is aimed as much at the facilitators as at Pyongyang — helping a sanctioned foreign government infiltrate US employers carries wire fraud, money laundering and identity theft charges.

What companies should do

The FBI's guidance is blunt: treat remote IT hiring as a security discipline. Red flags include candidates who refuse video interviews, insist on unusual onboarding arrangements, or have laptops shipped to addresses that do not match their stated location. Security teams are advised to verify identities through multiple independent channels, monitor for logins routed through VPNs or remote-desktop tools, and watch for the use of keyboard-video-mouse switches that let one person juggle several machines.

FAQs

How can a foreign national pass a US employment check?

The workers do not apply as North Koreans. They allegedly buy or steal the Social Security numbers, dates of birth and employment histories of real Americans — in this case, 25 citizens' identities were compromised — and build convincing digital lives around them: LinkedIn profiles with employment history, GitHub repositories, even manipulated video. Employment verification systems check that the documents look valid, not that the person on the webcam matches them.

What is a KVM device and why does it matter?

A KVM — keyboard, video, mouse — switch lets one set of peripherals control several computers. In a laptop farm, it allows a single facilitator to monitor and manage dozens of company-issued laptops from one desk. Prosecutors treat the presence of KVM hardware in a home office as a strong indicator of a farm.

Why does North Korea run this scheme instead of just hacking?

Traditional hacking is high-risk and intermittent; this scheme is steady income. An infiltrated employee draws a genuine salary, gains legitimate network access, and can steal intellectual property from the inside — all while the regime's involvement is invisible to the victim company. With sanctions strangling its conventional economy, Pyongyang treats these wages, like the estimated $2 billion in stolen crypto last year, as hard currency for its weapons programme.

Could my employer be affected without knowing it?

Possibly — and that is what worries the FBI. Warning signs include a remote employee who never appears on camera, logs in exclusively through VPNs, routes communications through unusual time zones, or shows gaps between claimed experience and actual ability. The DOJ did not name the 70 victim companies, so there is no public list to check against.

What happens to the seized laptops and the $3 million?

The devices become evidence in the criminal case, held until trial or forfeiture proceedings conclude. The money is subject to criminal forfeiture: if prosecutors prove it is the proceeds of the alleged fraud, a court can order it seized by the government. Identity-theft victims can also seek restitution through the sentencing process.