At least 70 U.S. companies unknowingly employed North Korean spies. That’s the headline buried inside the Justice Department’s latest enforcement action, and it should make any HR or security team deeply uncomfortable. According to TechCrunch, federal prosecutors have indicted and arrested at least two American nationals accused of running “laptop farms” out of their homes in Texas, helping North Korean IT workers fake their physical presence inside the United States.
Here’s how the scheme worked. North Korean operatives stole U.S. citizen identities, used them to get hired at American companies, then had their American co-conspirators receive and operate the work laptops that companies shipped to what they thought were new employees. Over 180 computers were seized across more than 40 addresses in Texas. The workers on the other end, sitting somewhere in North Korea or a neighboring country, had real access to real corporate systems. The companies in healthcare, retail, communications, manufacturing, and cyber support sectors across Ohio and 16 other states had no idea.
The DOJ says the hackers generated around $3 million in stolen funds from this wave of operations. But experts studying North Korea’s activities say the real numbers are almost certainly much higher. The regime is believed to have stolen at least $2 billion in cryptocurrency during 2025 alone, funding a nuclear weapons program that the international community has spent decades trying to strangle financially. The remote IT worker scheme is just one part of that picture, alongside hacks on crypto exchanges and open source developer projects.
CrowdStrike, which assisted the FBI in this investigation, described laptop farms as “vital” infrastructure for North Korea because they solve a core logistical problem: the hackers can’t physically be in the United States, so they need someone there to make it look like they are. And they are getting better at finding those someones. The DOJ warned that North Korean IT workers are now actively recruiting American facilitators to keep pace with improved detection from the private sector and law enforcement. Some operatives are reportedly subcontracting entire job roles to third-party foreign nationals.
The social engineering side of this is worth taking seriously. These aren’t sloppy, obvious fakes. North Korean operatives build convincing email identities, spoofed LinkedIn profiles, and full social media histories to back up their fake personas. Standard background checks often miss this. The FBI has said there are thousands of North Korean state-controlled IT workers currently embedded at Western companies, calling it a “significant national security and intellectual property theft insider threat.”
This is also not a new problem. It’s an escalating one. Arrests, indictments, and enforcement actions targeting North Korean operations have been mounting for years, but the regime keeps adapting. Earlier this year, CrowdStrike reported that North Korean hackers were responsible for roughly half of all documented human-operated intrusions over the past year. Not automated. Not AI-driven. People, sitting at keyboards, inside systems they were hired to work in. Companies that think their risk here is zero should reconsider that assumption fast.