The FBI has disrupted a network accused of helping North Korean IT workers secure remote jobs with American companies, seizing nearly 200 computers and dismantling more than 40 laptop farms in Texas.
US officials said the operation targeted a revenue stream believed to help fund North Korea’s nuclear and ballistic missile programmes while allowing the country to evade international sanctions.
The FBI said the laptop farms were operated by American facilitators who received and housed company equipment. North Korean operators then accessed the devices remotely and posed as US-based employees working for companies that had hired them.
“North Korea is deploying thousands of state-controlled I.T. workers to infiltrate companies in the United States and allied countries,” Brett Leatherman, head of the FBI’s cyber division, said.
“Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer,” he added.
The bureau worked with the US cybersecurity company CrowdStrike to identify and disrupt the network. Mr Leatherman said the operation was an early example of a new FBI cyber strategy focused on working more closely with private companies to obstruct malicious activity.
Separately, the Justice Department unsealed indictments in Ohio against two US nationals and 10 North Koreans based in China. Prosecutors allege the group used stolen identities to obtain wages from unsuspecting American companies, defrauding 70 businesses of more than $3 million between 2019 and 2025.
The identities of two other defendants remained under seal.
How the North Korean IT worker scheme operates
Investigators say facilitators in the United States help the fraudsters overcome corporate security checks by making remote workers appear to be located at genuine American addresses. The North Korean operators use software to connect to laptops installed there and carry out their work from abroad.
Some facilitators are drawn in by the prospect of easy money, according to Adam Meyers, who oversees counter-adversary operations at CrowdStrike. He said people could become increasingly involved until they were “in too deep” to withdraw easily.
Mr Leatherman said the Texas operation did not result in arrests, but facilitators were warned they could face criminal penalties if they continued helping with the alleged fraud. He said authorities acted quickly to disrupt the network rather than wait for criminal charges to be filed.
Some laptop farms functioned like a “mini data center”, Mr Leatherman said, with a single facilitator hosting dozens or even hundreds of machines used for multiple jobs.
The tactics have become more sophisticated, officials said. North Korean operators are increasingly using artificial intelligence to create false CVs, photographs and videos, and to take part in online job interviews.
They are also relying more heavily on subcontractors in countries including Pakistan and Nigeria to conceal their involvement. The FBI said accomplices were being paid to carry out tasks such as appearing on camera, attending meetings, verifying identities, shipping packages and completing urinalysis tests or fingerprint submissions.
US intelligence officials and cybersecurity researchers have warned for more than two years that stolen American identities and artificial intelligence tools were being used to obtain remote IT work in the United States, Europe and elsewhere.
CrowdStrike identified an average of two new laptop-farm cases a day during September, Mr Meyers said, adding that the figure was likely only a small part of the wider activity.
