DOJ indicts facilitators, raids 40 North Korean ‘laptop farms’ in Texas

The U.S. Department of Justice announced on October 13 that it has indicted at least two American facilitators and raided more than 40 “laptop farms” across Texas as part of a crackdown on North Korean operatives who used stolen American identities to get hired as remote IT workers at U.S. companies. Federal agents seized more than 180 computers that companies had shipped to what they believed were new domestic employees.

North Korea has run remote-IT-worker schemes for years to fund its sanctioned weapons programs, but this action is notable for its scale: the DOJ called the Texas raids the largest disclosed number of laptop farms uncovered in a single operation. A laptop farm lets a facilitator — typically a U.S. resident paid to participate — host company-issued laptops at a real American address and remotely enable North Korean workers overseas to log in and appear to be working from inside the country, defeating location checks employers rely on.

According to the DOJ, the scheme infiltrated at least 70 U.S.-based companies across Ohio and 16 other states plus Washington, D.C., spanning healthcare, cyber support, retail, communications, and manufacturing. Prosecutors estimate the operation generated roughly $3 million in stolen funds; the agency did not name the affected companies. The operatives used realistic email addresses, spoofed LinkedIn profiles, and built-out social media histories to pass employer background checks, and in some cases subcontracted entire jobs to other foreign nationals to avoid detection.

CrowdStrike, which assisted the FBI with the investigation, said laptop farms are “vital” infrastructure for the North Korean hacking operation it tracks as Famous Chollima and said the group was behind roughly half of all documented hands-on-keyboard intrusions CrowdStrike observed over the past year. A separate FBI public service announcement (PSA261013) issued alongside the DOJ action warns that thousands of North Korean state-controlled IT workers remain employed at Western companies beyond those identified in this case.

The remote-IT-worker scheme is one of several revenue streams North Korea uses to fund its nuclear and missile programs alongside direct cryptocurrency exchange hacks and compromises of open-source software projects; CrowdStrike estimates North Korean-linked actors stole at least $2 billion in cryptocurrency in 2025 alone. Security researchers believe the true number of companies that have unknowingly hired North Korean operatives, and the true scale of funds stolen, is significantly higher than what has been publicly disclosed. The DOJ's announcement and the FBI's PSA261013 were reported by Zack Whittaker for TechCrunch.