DOJ Uncovers North Korean Hacking Network Targeting 70 U.S. Firms

The U.S. Department of Justice (DOJ) has uncovered a North Korean operation that allegedly used American residents and networks of remote computers to infiltrate at least 70 U.S. companies. Authorities say the scheme involved North Korean IT workers using stolen American identities to secure jobs, access corporate systems, and steal sensitive information.

In an announcement on Tuesday, federal prosecutors said they had indicted and arrested at least two people and searched dozens of suspected “laptop farms” across Texas. Investigators believe these locations housed computers used by North Korean operatives to remotely access American companies while making it appear that the workers were operating from within the United States.

Federal authorities seized more than 180 computers that companies had reportedly shipped to their newly hired employees. According to the DOJ, the businesses did not realize that some of the supposed employees were sanctioned North Korean operatives using stolen identities.

Investigators searched more than 40 laptop farms across Texas, marking the largest publicly disclosed number of residences used to support North Korean hacking operations, according to the announcement. The properties were allegedly controlled by at least two American facilitators.

How North Korean Operatives Used Laptop Farms

The laptop farms helped North Korean IT workers overcome the practical challenges of operating remotely from outside the United States while appearing to be domestic employees.

Cybersecurity company CrowdStrike, which assisted the FBI in investigating and disrupting the latest operations, described these facilities as “vital” to North Korean hackers. They help the operatives overcome physical, financial, and legal obstacles that would otherwise make it harder to work inside the United States.

The DOJ said the operation affected at least 70 U.S.-based companies and generated an estimated $3 million in stolen funds. Officials did not identify the affected businesses by name, but said they operated in sectors including healthcare, cybersecurity support, retail, communications, and manufacturing.

The affected companies were located across Ohio and 16 other states, including the District of Columbia.

According to the Justice Department, North Korean IT workers are increasingly recruiting American facilitators to carry out a wider range of tasks. In some cases, the workers allegedly subcontracted entire jobs to third-party foreign nationals as private companies improved their detection systems and law enforcement stepped up investigations.

Fake Profiles Helped Workers Secure Jobs

North Korean operatives have reportedly relied on convincing email addresses, falsified LinkedIn profiles, and extensive online and social media accounts to support their identities and employment applications.

The FBI issued a separate public service announcement warning that thousands of North Korean state-controlled IT workers are employed at Western companies. The agency described the activity as a significant national security risk and a potential insider threat involving intellectual property theft.

Once hired, these workers can gain access to company systems, internal documents, and proprietary information. Authorities say the broader scheme involves stealing sensitive data and intellectual property, with some victim companies subsequently facing extortion demands from hackers seeking additional payments.

The strategy allows the North Korean regime to generate revenue through employment arrangements that initially appear legitimate while potentially gaining access to valuable corporate information.

Crypto Theft Remains Another Revenue Source

The latest enforcement action is part of a broader U.S. effort to disrupt North Korean operations targeting American businesses. The regime has also been linked to cyberattacks against cryptocurrency exchanges and open-source software development projects.

These activities are believed to help generate revenue for North Korea, which faces extensive international sanctions and is seeking to fund its nuclear weapons program.

North Korean hackers are thought to have stolen at least $2 billion in cryptocurrency during 2025 alone. Experts who study the country believe the actual number of affected companies and the total amount of stolen crypto could be significantly higher than publicly reported figures suggest.

The threat extends beyond automated cyberattacks. Earlier this year, CrowdStrike reported that North Korean hackers were responsible for approximately half of all documented “hands-on-keyboard” intrusions over the preceding year. The term refers to attacks carried out directly by human operators rather than automated tools or artificial intelligence.

Businesses Face Growing Insider Threat Risks

The laptop farm investigations highlight how remote hiring practices can be exploited when employers cannot adequately verify a worker’s identity, location, or employment history.

Unlike conventional hacking campaigns that attempt to break into corporate networks from the outside, the remote IT worker scheme can provide attackers with access through legitimate employee accounts. That access may allow them to operate within company systems while avoiding some of the warning signs associated with external attacks.

The DOJ’s latest actions underscore the importance of identity verification, secure device management, access controls, and continuous monitoring of employee accounts.

For businesses hiring remote technology workers, the challenge is not only defending against outsiders attempting to breach their systems. It is also ensuring that the people given legitimate access to company networks are who they claim to be.

Also read : WindBorne Lands $49M U.S. Air Force Deal for Weather Data