DOJ Seizes 180 Devices in North Korean Remote Worker Case
U.S. authorities target alleged North Korean remote-worker network
The U.S. Department of Justice has seized more than 180 computers and searched more than 40 suspected laptop farms in Texas in an operation targeting an alleged North Korean scheme to infiltrate U.S. companies through remote IT jobs. Prosecutors said at least 70 U.S.-based companies were affected and that the activity generated about $3 million in stolen funds.
The Justice Department said at least two people were indicted and arrested. The seized devices had allegedly been shipped by U.S. employers to newly hired workers who were, unbeknown to the companies, sanctioned North Korean operatives using stolen identities belonging to U.S. citizens.
The Texas searches represent the largest disclosed number of homes and residences allegedly used to facilitate North Korean hacking. Authorities said the locations were owned by at least two American facilitators and served as points from which overseas workers could access employer-issued computers.
Why laptop farms matter
CrowdStrike, which assisted the FBI investigation and disruption effort, described laptop farms as vital to North Korea’s ability to overcome the physical, financial and legal obstacles of operating from outside the United States. By placing a company-issued device at a U.S. address, an operative can appear to be a domestic employee while working remotely from elsewhere.
Prosecutors said the alleged victims included organizations in healthcare, cyber support, retail, communications and manufacturing. They were located in Ohio and 16 other states, as well as the District of Columbia. The Justice Department did not identify the companies.
The alleged workers used realistic email addresses, spoofed LinkedIn profiles and extensive online and social-media accounts to support their cover identities. The FBI has separately warned that thousands of North Korean state-controlled IT workers may be employed by Western companies, creating an insider threat to national security and intellectual property.
A changing facilitation model
The Justice Department said North Korean IT workers are increasingly recruiting U.S. facilitators as private-sector detection and law-enforcement actions improve. Facilitators may perform a broader set of tasks, while some roles are reportedly subcontracted to third-party foreign nationals.
The remote-worker operation is one of several revenue-generating activities attributed to North Korea. The model can produce wages and provide access to sensitive information and intellectual property, after which victim organizations may be extorted. The regime has also been linked to attacks on cryptocurrency exchanges and open-source developer projects, activities described as supporting its internationally sanctioned nuclear weapons programme.
For employers, the case makes identity assurance and remote-access governance operational security priorities. Hiring teams and security teams should verify worker identities, the delivery and use of company equipment, and account activity throughout employment rather than treating onboarding checks as a one-time control.