U.S. Department of Justice Warns of North Korean Hackers Exploiting American Accomplices to Infiltrate Domestic Companies

The United States Department of Justice has issued a stark warning regarding an evolving national security threat, revealing that state-sponsored hackers operating on behalf of the North Korean regime are increasingly relying on American residents to facilitate the infiltration of U.S. corporations.

In a coordinated enforcement announcement, federal prosecutors disclosed that they have formally indicted and arrested at least two individuals suspected of acting as domestic facilitators. Furthermore, law enforcement agencies executed targeted searches across more than forty suspected "laptop farms" located throughout the state of Texas. According to federal authorities, these residential setups were utilized by remote North Korean operatives to tunnel directly into American enterprise networks, allowing them to bypass geographical restrictions, evade internal security tripwires, and siphon sensitive corporate data.

Federal investigators seized more than 180 computing devices during the raids. These machines had originally been shipped by U.S. companies directly to their newly hired remote employees—unaware that the individuals on the receiving end were actually sanctioned North Korean cyber spies. These operatives had successfully secured legitimate employment by assuming the stolen identities of unsuspecting U.S. citizens. The sweeping operations across more than forty residential properties in Texas represent the largest disclosure to date of domestic locations dedicated to supporting North Korean network intrusions, with the hubs traced back to at least two primary American facilitators.

Cybersecurity firm CrowdStrike, which collaborated closely with the Federal Bureau of Investigation to investigate and disrupt these latest North Korean operations, explained that laptop farms serve an indispensable function for the regime. These domestic networks are vital in helping North Korean threat actors overcome the physical, financial, and legal barriers imposed by operating from outside the United States, effectively masking their foreign origins behind legitimate domestic internet service providers and residential hardware.

According to prosecutors, at least 70 U.S.-based companies have been successfully infiltrated by these operatives, generating an estimated $3 million in direct ill-gotten gains through wages and subsequent extortion demands. While the Department of Justice withheld the specific names of the impacted organizations, officials characterized the victims as spanning critical economic sectors, including healthcare, cybersecurity support, retail, communications, and manufacturing. These compromised entities were spread across Ohio and 16 other states, as well as the District of Columbia.

The Justice Department noted that North Korean IT workers are actively pivoting their tactics to counter improving detection measures implemented by the private sector alongside aggressive law enforcement interventions. Rather than relying solely on direct technical exploits, these cyber operatives are hiring local American facilitators to shoulder a wider variety of logistical tasks. In certain instances, these intermediaries have even been utilized to subcontract entire professional roles to other third-party foreign nationals, establishing a complex corporate front that shields the true perpetrators from view.

To maintain these deceptions, North Korean hackers routinely deploy sophisticated social engineering methods. They rely on realistic-looking email addresses, meticulously spoofed LinkedIn profiles, and extensive, fabricated online and social media histories to build credible professional personas that easily pass through remote recruitment pipelines.

In a separate public service announcement, the FBI cautioned that thousands of North Korean state-controlled IT workers are currently embedded within Western companies. The bureau warned that this persistent workforce constitutes a significant national security risk and a severe intellectual property theft insider threat, capable of executing malicious actions from deep within corporate perimeters.

This enforcement action forms part of a broader, ongoing wave of arrests, indictments, and regulatory crackdowns targeting covert North Korean operations inside the United States over recent years. The isolated regime has heavily leaned on this remote IT worker scheme as a lucrative pipeline, allowing operatives to secure legitimate employment with companies across the United States and Europe, draw standard salaries, and subsequently leverage their internal access to steal confidential information, proprietary source code, and trade secrets. Once sensitive intellectual property is secured, victimized companies are frequently targeted with extortion schemes, forcing leadership into paying further ransoms to prevent public data leaks.

The remote IT worker program is merely one strand of a multi-faceted illicit revenue generation strategy orchestrated by Pyongyang. Other prominent campaigns include daring cryptocurrency exchange hacks and supply-chain compromises targeting open-source developer repositories, all designed to fund the regime’s internationally sanctioned nuclear weapons program. Intelligence assessments indicate that the North Korean state managed to steal at least $2 billion in cryptocurrency during 2025 alone.

Independent security experts specializing in North Korean cyber operations suggest that the true scope of the problem—including the actual count of compromised enterprises and the total volume of stolen digital assets—is likely much higher than official figures currently reflect.

Reinforcing these concerns, a previous report published by CrowdStrike earlier this year revealed that North Korean state-backed threat actors were responsible for roughly half of all documented hands-on-keyboard intrusions over the preceding twelve-month period. These findings highlight a reliance on human-driven, targeted cyberattacks rather than automated scripts or artificial intelligence, underscoring the persistence, adaptability, and deliberate nature of the regime’s ongoing campaign against Western targets.