FBI disrupts North Korean 'laptop farms' used to fund weapons programs

A North Korean laptop farm is a place where U.S. facilitators house employer-issued computers. Workers overseas connect to those machines and perform jobs remotely. Because the computers sit inside the United States, company systems can show a U.S.-located device rather than the worker’s actual location.

The facilitators configure the laptops and add hardware or software for remote control. Keyboard-video-mouse equipment can also help overseas operators control computers. This arrangement lets workers use corporate systems while hiding that they are abroad. Some equipment was disguised to avoid security detection.

The scheme matters because it combines false identities with access to real employers. The workers can earn money for North Korea while entering systems at companies in aerospace, energy, health care, finance, defense engineering, and government technology. The FBI says each seized laptop may represent one company that hired a North Korean IT worker.

The Texas crackdown seized 187 devices, including laptops and keyboard-video-mouse equipment. Agents searched more than 40 residences across Texas, and prosecutors said about 100 devices came from North Texas. The equipment belonged to laptop farms supporting overseas workers.

The wider operation was larger than the Texas seizures. CrowdStrike said the campaign targeted more than 70 U.S. companies and involved two arrests in Ohio. The company did not identify those arrested or describe their charges. The Texas Justice Department release did not address the Ohio arrests.

The affected organizations covered aerospace, energy, financial services, health care, cybersecurity, defense engineering, and government technology. CrowdStrike said its work with the FBI disrupted several U.S. laptop farms in late September. The Justice Department said the investigation remains ongoing, and CrowdStrike warned that operators may adapt rather than stop permanently.

U.S.-based facilitators obtained employer-issued computers through several deceptive routes. Some workers filed false police reports saying laptops had been stolen, prompting employers to ship replacement devices elsewhere. Others claimed last-minute moves. Some obtained jobs through staffing firms, which allowed equipment to be redirected without those firms knowing.

After delivery, facilitators installed hardware and software that enabled overseas workers to operate the computers remotely. Keyboard-video-mouse equipment was among the devices seized. CrowdStrike also said operatives disguised equipment used in the scheme, making it harder for security teams to recognize the setup.

The arrangement concealed the worker’s real location while preserving access to corporate systems. Employers could see activity coming through a computer physically located in the United States, even though the person doing the work was overseas. The scheme reached companies in sensitive sectors, and one earlier case involved stolen export-controlled technical information.

North Korean workers used false identities to obtain remote jobs at U.S. companies while concealing that they were working abroad. A U.S.-located computer strengthened that disguise. It made the work appear to come from inside the country, helping the worker pass ordinary location checks.

The laptop-farm arrangement also gave workers access to corporate systems. U.S.-based facilitators received and configured employer-issued computers, then connected them to overseas operators. Those operators could perform IT work through machines physically located in the United States. The article describes this as a way to conceal overseas activity.

The financial motive was central. Authorities said the fraudulent jobs generated revenue for North Korea’s sanctioned weapons programs. Earnings were transferred to North Korean-controlled accounts. The operation therefore offered workers a way to obtain employment and offered the regime a stream of money, while potentially exposing U.S. companies to unauthorized access.

When fraudulent workers gain corporate access, they can do more than collect a paycheck. They may enter systems that hold sensitive business or technical information. The article links the scheme to organizations in defense engineering, government technology, health care, financial services, aerospace, energy, cybersecurity, and defense.

A previous case shows the danger clearly. Prosecutors alleged that an overseas worker accessed and stole export-controlled technical information from a California defense contractor developing artificial intelligence-powered equipment. The article also says a senior FBI official reported that at least one U.S. government contractor had been caught in the hiring schemes.

The immediate consequence can be unauthorized access to systems and information. The broader consequence is money flowing to North Korea’s weapons programs. Because workers and facilitators concealed the arrangement, employers might not realize who is operating their equipment. The FBI’s seizures disrupted farms, but CrowdStrike expects operators to adapt their methods.

The scheme converted fraudulent IT employment into revenue for North Korea. Workers obtained jobs under false identities, completed work through computers housed in the United States, and generated paychecks from U.S. companies. Authorities said those earnings supported the regime’s sanctioned weapons programs.

U.S.-based facilitators played the financial link. They configured employer-issued computers, helped overseas workers access them, and transferred earnings to North Korean-controlled accounts. The laptop farm hid the worker’s foreign location, while the false identity made the employment appear legitimate to the company.

The article does not describe every payment route or explain how each transfer bypassed sanctions. It does establish the central mechanism: fraudulent employment produced income, and facilitators moved that income to accounts controlled by North Korea. That means disrupting laptop farms can interrupt both unauthorized access and a funding channel, although CrowdStrike expects operators to change tactics.

Remote hiring separates the person from the workplace. An employer may communicate online and send equipment to an address, while another person operates the computer elsewhere. That makes it harder to confirm that the applicant, the worker, and the device location all match.

The scheme exploited that separation in several ways. Workers used false identities. Facilitators redirected laptops after false theft reports, claimed moves, or staffing-firm placements. They then installed tools that let overseas workers control computers physically located in the United States. The equipment could be disguised from security teams.

The article also shows that some checks still blocked access. Participants seeking contractor roles at Immigration and Customs Enforcement and the Federal Protective Service could not meet fingerprinting requirements. Yet another participant obtained a General Services Administration contractor position before being terminated five days after an introductory meeting. The cases show both vulnerability and limits in remote hiring controls.