U.S. DOJ Says North Korean IT Workers Infiltrated 70+ US Companies, Seizes Approx. 187 Devices

North Korean IT workers allegedly found a way into dozens of American companies by posing as legitimate remote employees. The US Department of Justice has now announced coordinated enforcement actions, including arrests, an indictment, and the seizure of approximately 187 devices. The operation highlights how fraudulent hiring can become a cybersecurity threat, even when companies believe they are recruiting ordinary remote workers.

North Korean IT workers allegedly used stolen US identities

According to the U.S. Department of Justice, the scheme affected more than 70 US employers and generated approximately $3 million in revenue (via TechCrunch). The money is believed to have reached entities controlled by North Korea.

Investigators say North Korean workers used stolen or fabricated identities, fake online profiles, and proxy infrastructure to obtain remote positions. American facilitators allegedly received company-issued laptops, configured the devices, installed remote-access software, and transferred earnings to North Korean-controlled accounts.

The affected employers operated across healthcare, communications, cybersecurity support, retail, and manufacturing. The companies were located across Ohio, 16 additional states, and Washington, DC.

FBI raids more than 40 suspected laptop farms

Under Operation Lonestar Roundup, federal agents searched more than 40 residences in Texas between September 21 and September 25. Authorities seized approximately 187 laptops and keyboard, video, and mouse devices allegedly used to facilitate the scheme.

The DOJ also announced arrests and an indictment connected to the broader operation. A separate Ohio case charged 14 people over an alleged conspiracy affecting more than 70 companies. The cases involve overlapping enforcement efforts, so the charges should not be treated as convictions.

Not to forget, CrowdStrike also played a role in disrupting the operation. In a new blog post, the cybersecurity firm detailed how it monitored customer networks for North Korean IT worker activity and assisted the FBI. The company helped identify activity linked to Famous Chollima, a North Korean threat group associated with fraudulent IT worker schemes. Not to forget, the FBI has also arrested a Saudi national over hiding a tracking device in OpenAI’s executive conference room.