FBI disrupts North Korean IT worker scheme across Texas laptop farms

The FBI and Justice Department announced on October 13 the disruption of a large-scale operation where North Korean nationals used stolen American identities to secure remote IT jobs at U.S. companies. Prosecutors unsealed indictments in Ohio against two U.S. citizens and 10 North Koreans based in China for identity theft and wire fraud.

Authorities raided more than 40 so-called "laptop farms" across Texas, seizing nearly 200 computer devices. These residences housed equipment shipped by employers to supposed new hires who were actually North Korean operatives working remotely. The scheme defrauded at least 70 companies across 17 states and the District of Columbia of more than $3 million between 2019 and 2025.

“Every one of these jobs is funding a stream for a nuclear and ballistic missiles programme obtained with the stolen identity of an American and the trust of an American employer.”

FBI Cyber Division head Brett Leatherman stated that thousands of state-controlled North Korean IT workers have infiltrated companies in the U.S. and allied nations. He emphasized that every fraudulent job funds the regime's nuclear and ballistic missile programs. The FBI coordinated the investigation with cybersecurity firm CrowdStrike.

The Justice Department warned that North Korean operatives are increasingly recruiting American facilitators to bypass improved corporate detection systems. These facilitators manage laptop farms and, in some cases, subcontract entire jobs to third-party foreign nationals. The FBI issued a public service announcement alerting employers to the threat.