DOJ Uncovers North Korean Hackers Using Americans to Infiltrate US Companies

The U.S. Department of Justice (DOJ) has disclosed that North Korean hackers are increasingly employing Americans to assist in cyber intrusions targeting U.S. companies. Prosecutors announced indictments and arrests of at least two individuals and executed searches at more than 40 suspected "laptop farms" in Texas, where computers were used remotely by North Korean operatives to steal sensitive data.

Federal authorities seized over 180 computers believed to have been shipped by American companies to employees who were actually North Korean agents using stolen U.S. identities. These laptop farms represent a significant infrastructure enabling North Korean hackers to bypass geographic and legal barriers to access U.S. networks.

CrowdStrike, which collaborated with the FBI on the investigation, noted that these laptop farms are critical for North Korea to conduct cyber operations from abroad. The DOJ reported that hackers infiltrated at least 70 U.S.-based companies across sectors including healthcare, cyber support, retail, communications, and manufacturing, spanning Ohio and 16 other states plus the District of Columbia.

The DOJ highlighted a growing trend of North Korean IT workers recruiting American facilitators to evade detection by private sector cybersecurity and law enforcement. These facilitators sometimes subcontract tasks to other foreign nationals. The hackers use sophisticated cover tactics such as realistic email addresses, spoofed LinkedIn profiles, and active social media accounts.

The FBI also issued a warning about thousands of North Korean state-controlled IT workers embedded in Western companies, posing significant national security and intellectual property risks.

This investigation is part of a broader crackdown on North Korean cyber activities in the U.S., where the regime employs remote IT workers to steal information and extort victim companies. These cyber operations are among several illicit revenue streams, including cryptocurrency theft, which experts estimate to have reached billions of dollars, funding North Korea’s sanctioned nuclear weapons program.

CrowdStrike previously reported that North Korean hackers were responsible for about half of all documented manual cyber intrusions in the past year, emphasizing the persistent threat posed by human-operated attacks rather than automated tools.