North Korean Hackers Infiltrate Dozens of US Companies Using American Facilitators, DOJ Warns

Image: TechCrunch · Source

The US Justice Department reveals that North Korean hackers employ Americans as facilitators to breach at least 70 US companies, using stolen identities and laptop farms primarily in Texas to steal data and generate millions.

The US Department of Justice (DOJ) has issued a warning about an alarming escalation in cyberattacks by North Korean state-backed hackers targeting American companies with new strategies involving domestic facilitators. According to a recent DOJ announcement, these hackers increasingly employ Americans—some unknowingly—to assist in breaching corporate networks across the United States.

The DOJ disclosed indictments, arrests, and searches conducted at over 40 so-called “laptop farms” in Texas where more than 180 computers were seized. These laptop farms were infrastructure hubs alleged to be used by North Korean operatives who had obtained employment through stolen US identities to remotely infiltrate businesses. The raids uncovered two American facilitators orchestrating these operations.

CrowdStrike, which collaborated with the FBI during the investigation, underscored the vital role of these laptop farms, explaining how they allow North Korean hackers to bypass logistical, financial, and legal challenges inherent in operating physically outside the US. The DOJ reports that at least 70 US companies spanning sectors such as healthcare, cybersecurity support, retail, communications, and manufacturing across Ohio and 16 other states, including Washington DC, have been compromised.

These intrusions are financially significant; the DOJ estimates hackers accumulated around $3 million through these breaches. The hackers utilize sophisticated deception methods, including fabricated email addresses, spoofed LinkedIn profiles, and extensive social media accounts to conceal their activities. Additionally, the FBI has highlighted the presence of thousands of North Korean state-controlled IT workers embedded in Western companies, posing critical national security and intellectual property risks.

This campaign is part of a broader North Korean strategy termed the “remote IT workers” scheme, allowing operatives to legally work within US and European companies, collect salaries, and exfiltrate sensitive corporate data. Victimized companies often face extortion attempts following the theft.

North Korea’s cyber operations extend beyond traditional hacking, involving crypto theft and targeting open-source projects to finance its sanctioned nuclear weapons program. In 2025 alone, the regime reportedly stole over $2 billion in cryptocurrencies, a sum experts believe is underestimated. CrowdStrike’s recent reports attribute about half of all known manual, human-driven cyber intrusions in the past year to North Korean actors.

These findings illuminate the evolving tactics of North Korean cyber espionage and the persistent risks posed to US corporate and national security interests. Law enforcement agencies continue efforts to dismantle these networks and raise awareness about the increasing sophistication of insider-facilitated cyber threats originating from hostile states.