The United States Department of Justice has warned that North Korean operatives are increasingly recruiting American facilitators to help them infiltrate US companies, steal sensitive information and generate illegal revenue.

Prosecutors announced on this week that at least two people had been indicted and arrested, while authorities conducted searches at more than 40 suspected laptop farms across Texas.

Investigators seized more than 180 computers allegedly used to facilitate the operations, which involved North Korean operatives using stolen American identities to secure remote employment with US companies.

According to the Justice Department, the computers had been shipped by American companies to individuals they believed were legitimate employees but who were allegedly connected to North Korean intelligence operations.

The laptop farms, operated from residential properties by American facilitators, allowed North Korean workers to access company systems remotely while concealing their actual locations.

Cybersecurity firm CrowdStrike, which assisted the Federal Bureau of Investigation in investigating and disrupting the operations, described these facilities as essential to helping North Korean operatives overcome physical, financial and legal barriers to working inside the United States.

Prosecutors said at least 70 US companies had been infiltrated, with the operations allegedly generating approximately $3 million in stolen funds.

The affected organisations operate in sectors including healthcare, cybersecurity support, retail, communications and manufacturing across Ohio and 16 other states, as well as the District of Columbia.

The Justice Department said North Korean information technology workers were increasingly hiring American facilitators to evade improved cybersecurity detection and law enforcement measures, with some workers subcontracting entire jobs to foreign nationals.

The Federal Bureau of Investigation has separately warned that thousands of North Korean state controlled information technology workers are employed by Western companies, creating significant national security and intellectual property risks.

These operatives frequently use convincing email addresses, fabricated professional profiles and extensive social media accounts to appear legitimate.

Once employed, they may steal confidential information, intellectual property and other sensitive data, with some operations involving subsequent extortion of affected companies.

The scheme is part of North Korea’s broader efforts to generate revenue for its government and fund its internationally sanctioned nuclear weapons programme.

Other activities include cryptocurrency theft and attacks on software development projects.

North Korean operatives are believed to have stolen at least $2 billion in cryptocurrency during 2025 alone, although experts suspect the actual figures could be significantly higher.

Earlier reports from CrowdStrike also indicated that North Korean hackers accounted for approximately half of documented hands on keyboard cyber intrusions over the preceding year, highlighting the growing scale of the threat.

Source: TechCrunch