North Korean Hackers Infiltrate U.S. Firms Using Domestic Laptop Farms

The Department of Justice confirmed the seizure of more than 180 computers and raids on 40 residences used to facilitate these intrusions. Investigators discovered that North Korean agents posed as legitimate U.S. employees, often using spoofed LinkedIn profiles and falsified social media histories to gain access to sensitive corporate networks. These workers then subcontracted their roles to foreign nationals, creating a persistent insider threat that spans sectors including healthcare, manufacturing, and retail.

CrowdStrike, which assisted the FBI in the operation, noted that these laptop farms are essential for the regime to overcome the physical and legal barriers of operating from abroad. While the government did not disclose the names of the victims, the infiltration touched 17 states and the District of Columbia. The illicit activity generated approximately $3 million in direct funds, though officials warn this is a small fraction of a broader revenue-generating strategy. Beyond corporate theft, the regime continues to target cryptocurrency exchanges and open-source projects, with intelligence estimates suggesting billions in stolen assets are funneled directly into North Korea’s nuclear weapons program.