Threats · 4h ago
The Justice Department arrested two U.S. facilitators and seized 187 laptops in a North Korean IT worker scheme that touched more than 70 U.S. employers and brought in over $3 million, SecurityWeek reports. The case moved from allegation to enforcement action on day 0, with Texas searches tied to the laptop-farm setup.
The operation worked by pairing fake or stolen identities with company-issued laptops that U.S.-based helpers kept powered on, connected, and logged in from inside the United States. To the employer, the worker looked local even when the person using the account was not, so normal location checks and device custody signals could both be faked at once.
For companies that hire remotely and ship out laptops, the exposed layer is the onboarding and identity-verification chain, not just the endpoint. The confirmed scale also shows this is a repeatable domestic proxy model: many employers can inherit persistent access from the same infrastructure, even when no single company thinks it has a one-off insider case.
5 sources covering this story
FBI raids 40+ laptop farms helping North Korea pocket US tech salaries - Help Net Security
US authorities made two arrests, charged 14 people and searched more than 40 suspected laptop farms tied to North Korean IT workers.
US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.
Justice Department says North Koreans have infiltrated dozens of U.S. companies | TechCrunch
U.S. authorities warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached U.S. companies and Pyongyang.
DOJ charges 14 over a sprawling North Korean remote work scheme
Federal authorities charged 14 people and raided dozens of Texas laptop farms that helped North Korean operatives funnel $3 million from 70 US employers.
The Record from Recorded Future
Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.
Part of the PlainSec briefing for 2026-10-14