US DOJ says North Koreans infiltrated dozens of American firms

The U.S. Department of Justice has issued a major warning regarding North Korean hackers increasingly recruiting American facilitators to infiltrate and compromise U.S. corporations. In an announcement made on Tuesday, federal prosecutors disclosed that they have indicted and arrested at least two individuals while executing search warrants across dozens of suspected "laptop farms" located within the state of Texas, which served as remote bases for hacking American enterprises.

According to federal authorities working alongside cybersecurity firm CrowdStrike, law enforcement seized over 180 computers that U.S. companies had shipped to newly hired workers—unaware those employees were actually sanctioned North Korean operatives using stolen American identities. The raids targeted more than 40 residences and properties across Texas, marking the largest disclosed operation of its kind, with at least two American facilitators owning the properties used to host the equipment.

Prosecutors reported that at least 70 companies based in the United States were successfully infiltrated, generating roughly $3 million in stolen assets and extortion payments. While the Justice Department withheld the names of the impacted organizations, it specified that victimized sectors include healthcare, cyber support, retail, communications, and manufacturing spread across Ohio and 16 other states, alongside the District of Columbia.

Stock photo for illustration only, not from the actual event

The Justice Department noted that North Korean IT workers are actively recruiting American intermediaries to bypass improved security detections by private entities and law enforcement agencies. These operatives hire local facilitators to manage various tasks and occasionally subcontract work to foreign nationals. To maintain their cover, the hackers frequently rely on realistic email addresses, spoofed LinkedIn accounts, and extensive social media footprints.