Dozens of US companies infiltrated by North Korean hackers
What's the story
The US Department of Justice (DOJ) has raised alarms over a growing trend of North Korean hackers using American citizens as accomplices to breach US companies. Yesterday, the DOJ announced the indictment and arrest of at least two individuals in connection with this scheme. The department also conducted searches at over 40 suspected "laptop farms" across Texas, which were allegedly used by these hackers for remote infiltration into American firms and data theft.
Infiltration method
Laptop farms vital for North Korean hackers
The DOJ revealed that federal authorities seized over 180 computers believed to have been sent by American companies to their new employees.
These individuals were actually sanctioned North Korean spies who had used stolen identities of US citizens to get hired.
CrowdStrike, which assisted the FBI in disrupting these operations, said laptop farms are "vital" for North Korea's hackers as they help them overcome physical, financial, and legal challenges of not being physically present in America.
Targeted industries
At least 70 US firms targeted by hackers
The DOJ revealed that at least 70 US-based companies have been targeted by these hackers, who are believed to have stolen around $3 million.
The affected companies span the healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states including Washington DC.
The Justice Department said that North Korean IT workers are increasingly recruiting American facilitators to bypass improved private sector detections and law enforcement actions.
Security threat
Thousands of North Korean IT workers in West
The FBI has also warned that there are "thousands" of North Korean-controlled IT workers working at Western companies, posing a major national security and intellectual property theft insider threat.
The regime has used this "remote IT workers" scheme to get North Koreans hired by US and European companies, who then steal sensitive information while employed.
Funding sources
Illicit revenue streams for North Korea
The "remote IT workers" scheme is just one of the many illicit revenue streams the North Korean regime exploits.
Others include hacking cryptocurrency exchanges and open-source developer projects, all aimed at funding its internationally sanctioned nuclear weapons program.
The regime is believed to have stolen at least $2 billion in crypto during 2025 alone.
Experts believe the number of hacked companies and stolen crypto could be much higher than reported.