\n<\/p>\n
The U.S. Department of Justice is warning that hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of U.S. companies.<\/p>\n
In an announcement<\/a> on Tuesday, prosecutors said they have indicted and arrested at least two people, and conducted searches across dozens of suspected \u201claptop farms\u201d in Texas. The computers were allegedly used by North Koreans to remotely hack into American companies and steal sensitive data.<\/p>\n According to the DOJ, federal authorities seized over 180 computers that they believe American companies had shipped out to their newly hired employees, not realizing that they were sanctioned North Korean spies who had used stolen identities of U.S. citizens to gain employment. The DOJ said that it raided over 40 laptop farms across Texas, the largest disclosed number of homes and residences used for facilitating North Korean hacks, which were owned by at least two American facilitators.<\/p>\n CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said<\/a> that laptop farms are \u201cvital\u201d to North Korea in helping its\u00a0hackers overcome physical, financial, and legal challenges of not physically being in the United States.<\/p>\n The prosecutors said at least 70 U.S.-based companies had been infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies, but described them as healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.<\/p>\n \u201cIncreasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,\u201d the Justice Department said<\/a>.\u00a0<\/p>\n Oftentimes, North Korean hackers use real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts as cover for their activities.<\/p>\n In a separate public service announcement<\/a>, the FBI said that there are \u201cthousands\u201d of North Korean-state controlled IT workers working at Western companies, which \u201cpose a significant national security and intellectual property theft insider threat.\u201d<\/p>\n This is the latest wave of arrests, indictments, and enforcement action targeting North Korean activities in the United States in recent years. The breakaway regime has used this \u201cremote IT workers\u201d scheme to allow North Koreans to gain employment with U.S. and European companies, earn a wage, and then steal sensitive information and intellectual property while as employees. The victim companies are then extorted into paying the hackers further.\u00a0<\/p>\n The remote IT workers\u2019 scheme is one of several strands of illicit revenue that the North Korean regime aims to generate, including hacking crypto exchanges<\/a> and open-source developer projects<\/a>, with the aim of funding its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025<\/a> alone.<\/p>\n Experts on North Korea have put the number of hacked companies and the amount of stolen crypto as likely much higher than reported.<\/p>\n Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind around half of all documented \u201chands-on-keyboard\u201d intrusions over the past year, referring to hacks that are carried out by humans and not automated tools or AI.\u00a0<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n