North Korean Hackers Infiltrate 70+ U.S. Companies Using American Facilitators and Fake Identities

Massive Coordinated Infiltration Network Exposed

Federal prosecutors have dismantled a sprawling operation in which North Korean state-sponsored hackers infiltrated more than 70 American companies across healthcare, retail, manufacturing, and communications sectors. The Department of Justice announced the indictment and arrest of at least two American facilitators who enabled the scheme. Authorities conducted raids on over 40 locations in Texas described as "laptop farms"—residential properties outfitted with computers that North Korean operatives used to remotely access American corporate networks. Federal agents seized more than 180 computers that had been shipped to newly hired employees, who were actually North Korean intelligence operatives masquerading under stolen identities of U.S. citizens.

The scheme generated approximately $3 million in stolen funds, though cybersecurity experts believe the actual theft volume is substantially higher. Companies across Ohio and 16 other states plus Washington D.C. fell victim to the operation. North Korean hackers created convincing cover stories using spoofed LinkedIn profiles, authentic-appearing email addresses, and extensive social media accounts to pose as legitimate remote IT workers seeking employment at American firms.

Growing Reliance on American Accomplices

Prosecutors emphasized that North Korean IT workers are increasingly sophisticated in recruiting American facilitators to help circumvent detection systems and law enforcement capabilities. The operation expanded to include hiring facilitators for diverse roles and even subcontracting entire jobs to foreign nationals outside North Korea. This diversification reflects an adaptation strategy designed to exploit improved private sector cybersecurity defenses.

CrowdStrike, the cybersecurity firm that assisted the FBI in disrupting these operations, noted that laptop farms are strategically vital to North Korean operations. They allow state-sponsored hackers to overcome the physical, financial, and legal barriers that would prevent them from operating directly from North Korean territory. The infrastructure enables North Korean personnel to maintain employment relationships with American companies while conducting surveillance and theft from remote locations.

Broader National Security Implications

The FBI issued a separate public service announcement warning that thousands of North Korean state-controlled IT workers currently hold positions at Western companies, representing a significant national security and intellectual property theft risk. The remote IT worker scheme represents just one revenue stream for the sanctions-isolated regime, which also targets cryptocurrency exchanges and open-source developer projects to generate funds for its nuclear weapons program.

During 2025 alone, North Korea is believed to have stolen at least $2 billion in cryptocurrency, though independent analysts suspect actual totals exceed reported figures. Recent data from CrowdStrike indicated that North Korean hackers were responsible for approximately half of all documented "hands-on-keyboard" intrusions—sophisticated cyberattacks conducted by human operators rather than automated systems or artificial intelligence—over the past year. The operation reflects a sophisticated criminal enterprise designed not only to steal data but to extort victim companies into paying additional ransom demands.