The F.B.I. last month disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programs, U.S. officials said Tuesday.
The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by U.S. authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.
The Justice Department separately unsealed indictments in Ohio on Tuesday against two U.S. nationals and 10 China-based North Koreans accused of committing identity theft to earn paychecks from unwitting American companies that hired them. Prosecutors said that scheme bilked 70 companies out of more than $3 million and ran from 2019 to 2025. The identities of two additional defendants remained under seal.
The moves were the latest by the United States in an intensifying campaign to try to cut off a stealthy and evolving digital threat from North Korea whose scale is not entirely clear but likely vast. U.S. intelligence officials in both the Biden and second Trump administrations have said the I.T. worker scams are a primary method of funding Pyongyang’s weapons program, alongside thefts of cryptocurrency.
North Korea is deploying “thousands of state-controlled I.T. workers to infiltrate companies in the United States and allied countries,” Brett Leatherman, the head of the F.B.I.’s cyber division, said in an interview. “Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer.”
The bureau worked closely with the U.S.-based cybersecurity firm CrowdStrike to identify and disrupt the network, Mr. Leatherman said. He added that the coordinated actions were an early example of the F.B.I.’s new cyber strategy, which was unveiled last month and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity. The strategy is part of a broader effort across the Trump administration to work more closely with American companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.
U.S. officials and cybersecurity analysts have said the North Korean I.T. worker scheme is among the most serious ongoing digital threats facing businesses today, and that it remains underappreciated as a risk. Adam Meyers, who oversees counteradversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity.”
It is difficult to know how widespread laptop farms are in the United States, Mr. Meyers said, but noted that CrowdStrike identified an average of two new cases per day throughout the month of September — which is likely only the tip of the iceberg.
For more than two years, U.S. intelligence officials and cybersecurity researchers have warned that North Korea has been using stolen American identities — often acquired from compromised private information, like Social Security numbers, on the dark web — and artificial intelligence tools to get hired for remote information technology jobs at companies across the United States, Europe and elsewhere. Experts have said companies ranging from small start-ups to Fortune 500 firms have been victimized.
A crucial aspect of the fraud campaign is support from people in the United States who are recruited by North Korea to help bypass corporate security measures that detect fraudulent hires, according to investigators. Facilitators help enable the fraud by receiving and setting up work laptops at addresses that appear like legitimate residences to corporate human-resources teams. North Korean operators then use software to remotely tunnel into those laptops and work on them, posing as Americans to the companies that hired them.
The appeal for facilitators is simple: jobs that look like easy cash and, at least at first, might not require much of them. “They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Mr. Meyers said.
Mr. Leatherman said that the Texas sweep did not include any arrests of facilitators, but that authorities warned them they could face criminal penalties should they continue to assist with remote fraud. The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges, he said.
Mr. Leatherman said the laptop farms often operate like a “mini data center” for the North Koreans, where one facilitator hosts dozens or even hundreds of laptops used to fill scores of jobs. A woman in Arizona sentenced last year to more than eight years in prison was accused of hosting dozens of laptops at her home to help North Koreans connect to more than 300 U.S. companies.
The tactics of North Korea’s I.T. worker army have steadily evolved to evade detection. That includes increased reliance on artificial intelligence to create fake résumés, videos and photos, and to navigate virtual job interviews, officials said. The fraudsters are also relying more on subcontractors in places like Pakistan and Nigeria to further obscure North Korean involvement, Mr. Leatherman said.
In an advisory released on Tuesday, the F.B.I. said the North Koreans were paying Americans and other Western accomplices to “perform a growing variety of identity and location obfuscation tasks” that included appearing on camera, participating in job interviews or meetings, verifying fraudulent identities, shipping packages, and even completing urinalysis tests or fingerprint submissions.
The post F.B.I. Disrupts Pyongyang Revenue Stream: North Koreans in U.S. Tech Jobs appeared first on New York Times.
