The U.S. Department of Justice has announced a major crackdown on a North Korea hack ring that has been infiltrating American businesses through a network of remote workers and local facilitators. Federal prosecutors revealed that they have arrested at least two individuals and conducted raids on dozens of suspected “laptop farms” across Texas.
According to the DOJ, the operation involved North Korean hackers who used stolen identities to secure employment with U.S. companies. These employees, often posing as IT workers, were sent home with company laptops. The devices were then used to remotely hack into corporate networks and steal sensitive data.
Texas Laptop Farms Seized
Authorities seized more than 180 computers during the operation. The DOJ stated that these machines were shipped to newly hired employees who were unaware they were working for sanctioned North Korean spies. The raids targeted over 40 locations in Texas, marking the largest number of residences linked to this specific scheme to date.
At least two American facilitators were identified as owning or managing these laptop farms. These individuals allegedly helped the hackers overcome the physical, financial, and legal barriers of operating from outside the United States. CrowdStrike, which assisted the FBI in the investigation, described these farms as vital to the regime’s cyber operations.
70 Companies Infiltrated
Prosecutors estimate that at least 70 U.S.-based companies were compromised by the hackers. The group is believed to have generated approximately $3 million in stolen funds. The affected organizations span multiple sectors, including healthcare, retail, communications, manufacturing, and cyber support.
The intrusions were not limited to Texas. The DOJ reported that the hack ring operated across Ohio and 16 other states, including the District of Columbia. The department did not release the names of the victim companies, citing ongoing investigations.
The Justice Department highlighted a shift in tactics by North Korean operatives. In a statement, prosecutors noted that these workers are increasingly recruiting American facilitators to bypass improved private sector detections and law enforcement actions. In some cases, the hackers subcontract entire jobs to third-party foreign nationals.
The FBI issued a separate public service warning, stating that thousands of North Korean-state controlled IT workers are embedded in Western companies. These individuals pose a significant national security and intellectual property theft insider threat. The hackers often use sophisticated cover stories, including real-looking email addresses and spoofed LinkedIn profiles, to gain trust.
This enforcement action is part of a broader effort to disrupt illicit revenue streams for the North Korean regime. The remote IT worker scheme is one of several methods the regime uses to fund its nuclear weapons program, alongside hacking crypto exchanges and open-source developer projects. Experts estimate the regime stole at least $2 billion in cryptocurrency during 2025 alone.
CrowdStrike reported earlier this year that North Korean hackers were responsible for roughly half of all documented “hands-on-keyboard” intrusions over the past year. These are attacks carried out by human operators rather than automated tools. The true scale of the damage is likely higher than official figures suggest, as many companies may not detect the breaches immediately.
The DOJ continues to pursue those involved in the scheme. The arrests and seizures in Texas represent a significant step in dismantling the infrastructure that supports these cyber operations. Federal authorities are urging companies to review their hiring practices and remote work policies to prevent similar infiltrations.
Source: TechCrunch
