A North Korean laptop farm operation used by information technology workers to secretly infiltrate US companies and generate illicit revenue has been uncovered by federal authorities.
US Law Enforcement Dismantle Illegal Network
The FBI and the US Attorney’s Office for the Northern District of Texas announced on the 13th (local time) that they dismantled an illegal network of North Korean IT workers through coordinated operations across the state. Investigators searched over 40 residences, seizing 187 items including laptops and keyboards that the workers used to infiltrate US corporations. Joseph Rothrock, special agent in charge of the FBI Dallas field office, stated that the operation aimed to disrupt malicious cyber activities conducted by the North Korean government to support weapons of mass destruction, ballistic missiles, and nuclear programs, noting that each seized laptop represents a company that hired North Korean IT personnel.
How the Remote Work Scam Operated
The North Korean workers secured jobs by stealing or forging US identification documents and utilizing virtual private networks to create the illusion of working from within the United States. VPNs masked their true locations to conceal that the actual workplace was North Korea. US-based accomplices followed instructions from North Korean recruiters to help bypass corporate security systems. After receiving and setting up laptops sent by companies for remote work at their homes, they installed remote access software allowing North Korean IT workers and hackers to connect to the devices. These accomplices also collected corporate salaries on their behalf and transferred the funds to accounts controlled by the North Korean regime.
Funding Nuclear and Missile Programs
US intelligence agencies have long identified illicit IT worker employment schemes, alongside cryptocurrency theft, as primary methods for funding North Korea’s nuclear and missile development. In 2024 alone, North Korean IT workers amassed approximately $800 million through these tactics. Brett Leatherman, FBI cyber division deputy assistant director, emphasized that North Korea deploys thousands of IT workers to infiltrate companies in the US and allied nations, pointing out that every secured job steals a US identity and channels funds into missile programs.
