The U.S. Department of Justice has revealed that North Korean hackers have infiltrated dozens of American companies by enlisting U.S.-based facilitators to assist with their cyber activities. Recent coordinated actions led to indictments, arrests, and searches in Texas targeting "laptop farms" used by North Korean operatives remotely accessing company systems. Authorities seized over 180 computers, which had been unknowingly shipped by U.S. firms to individuals posing as new employees but identified as North Korean spies using stolen U.S. identities.

The DOJ's investigation uncovered more than 40 locations in Texas connected to these operations, revealing the scale and sophistication of the hacking network. The hackers are reported to have compromised at least 70 companies across multiple industries, including healthcare, cyber support, retail, communications, and manufacturing, across Ohio and 16 other states plus Washington, D.C. CrowdStrike, a cybersecurity firm involved with the FBI, emphasized the importance of these laptop farms to North Korea for bypassing the challenges of not being physically present in the U.S.

North Korean hackers have increasingly relied on American facilitators to perform a wider array of tasks, including subcontracting work to foreign nationals to evade detection. Their tactics include creating convincing online identities with legitimate-looking emails and LinkedIn profiles to blend into the workforce. The FBI has also issued warnings about thousands of North Korean IT workers employed by Western firms, highlighting the substantial risks these insiders pose to national security and intellectual property.

This crackdown is part of a broader effort to counter North Korea’s remote IT worker scheme, which is a key mechanism for earning illicit income to support Pyongyang’s sanctioned nuclear weapons program. The regime’s cyber activities have also involved stealing billions in cryptocurrency and hijacking open-source projects. Security experts note that North Korean hackers were responsible for nearly half of all validated hands-on keyboard intrusions recorded recently, underscoring the persistent and evolving nature of this threat.