Justice Department Says North Koreans Infiltrated US Companies

The United States Department of Justice has issued a stark warning regarding an escalating cybersecurity threat involving state-backed hackers from North Korea. According to federal prosecutors, these malicious actors are increasingly relying on American facilitators to assist them in infiltrating U.S. corporations. In a coordinated announcement, officials revealed that they have successfully indicted and arrested multiple individuals while executing search warrants across dozens of suspected operations in Texas.

These targeted locations, often referred to as laptop farms, were utilized by North Korean operatives to remotely connect to American corporate networks. By masking their true locations, the hackers could operate as legitimate remote employees. Federal authorities successfully seized over 180 computers that unsuspecting U.S. companies had shipped directly to their newly hired remote workers. Unbeknownst to the employers, these workers were actually sanctioned North Korean spies who utilized stolen identities belonging to American citizens to secure employment.

The investigation, which received crucial technical assistance from cybersecurity firm CrowdStrike and the FBI, uncovered more than 40 laptop farms located across Texas. This represents the largest known cluster of residential hubs used to facilitate North Korean digital espionage and corporate infiltration. Investigators estimate that at least 70 U.S.-based companies have been successfully compromised by these operatives, generating an estimated $3 million in illicit funds through salary accumulation and extortion schemes.

While the Department of Justice chose to withhold the specific names of the victim organizations to protect an ongoing investigation, they confirmed that the affected sectors span across multiple industries. Organizations in healthcare, cybersecurity support, retail, communications, and manufacturing were targeted across 16 states and the District of Columbia. The geographic diversity and sectoral breadth of the attacks highlight the systemic nature of the threat facing American corporate infrastructure.

Security experts point out that North Korean IT workers are actively recruiting local facilitators to counter increasingly sophisticated private sector threat detection tools and aggressive law enforcement actions. These operatives routinely hire local intermediaries to complete administrative tasks, handle payroll logistics, and in some cases, subcontract entire job responsibilities to third-party foreign nationals. To maintain their cover, the hackers deploy highly polished digital facades, including realistic email addresses, elaborate fake LinkedIn profiles, and extensive social media histories.

In a parallel advisory, the Federal Bureau of Investigation cautioned that thousands of state-controlled North Korean IT workers currently maintain positions within Western corporations. These embedded individuals pose a continuous and severe national security risk, serving as an insider threat capable of intellectual property theft and network sabotage. This enforcement action marks the latest escalation in a long-standing campaign by American authorities to disrupt North Korea's remote IT worker schemes.

The deceptive employment scheme is merely one component of a broader illicit revenue generation strategy orchestrated by Pyongyang. Alongside corporate infiltration, the regime continues to fund its internationally sanctioned nuclear weapons program through aggressive cryptocurrency exchange hacks and targeted compromises of popular open-source software developer projects. As detection methods evolve, federal agencies continue to urge businesses to implement rigorous identity verification protocols to protect their corporate networks from foreign infiltration.