FBI agents have raided more than 40 homes in Texas and seized 187 computers in a bizarre scheme allegedly helping North Korean operatives infiltrate more than 70 American companies — all from laptops hidden in ordinary homes.
So-called "laptop farms" let North Korean IT workers pretend to be employees living in the US. They collected American salaries and sent millions of dollars back to groups tied to Kim Jong Un's government.
The problem isn't just fake job applications. Investigators warn that company laptops could also give overseas workers a way into sensitive business data, turning a normal remote-work setup into a possible national security threat.
The US Department of Justice announced a coordinated crackdown on Tuesday. It says a network of facilitators helped overseas workers land jobs at American businesses while masking their true identities and locations.
According to an Ohio indictment, more than 70 American companies were caught up in the scheme, from healthcare and communications to retail and manufacturing. Roughly $3 million (£2.26 million) in earnings is believed to have ended up with North Korean-run entities that the US has sanctioned.
Behind the Front Doors of Everyday US Homes, a Hidden North Korean Operation.
The trick was simple. Company laptops stayed in American homes, while the real users worked from far away.
From 21 September to 25 September, the FBI raided and searched more than 40 homes in Texas believed to be laptop farms.
Here's how it allegedly worked. North Korean IT workers used stolen or made-up identities to get remote jobs at US companies. US-based helpers kept the work laptops at home, and the workers abroad logged in from there. On paper, they looked like regular employees working in the States.
So who would keep dozens of laptops running in their house, and what did they really know? US Attorney Ryan Raybould says hosts who knew what was going on could face charges. "It's very hard to claim you didn't know what you were doing when you're hosting 30, 40, 50 laptops in your house," he said.
Fake Identities, Remote Access and a Hidden Security Risk
Pretending to live in the US was only part of the alleged scheme.
According to authorities, the workers hid their real locations using fake emails, invented identities, social media profiles, VPNs and proxy networks. Investigators also seized KVM devices, which let someone control multiple computers from afar. Those tools aren't illegal on their own, but authorities say they helped overseas workers pass as real American employees.
The fake paycheck is just the beginning. A work laptop can give access to internal systems, company files and sensitive data, which puts data security, intellectual property and customer privacy at risk.
That said, authorities haven't confirmed that every company involved was hacked. The FBI's advice to US businesses: check identities properly and look closely at the backgrounds of remote job applicants.
Millions Earned, and a Much Bigger North Korean Operation Behind It
The money is big, but the numbers need context.
The Ohio indictment links this scheme to roughly $3 million (£2.26 million), believed to have gone to North Korean-controlled entities. Authorities call the wider network of IT workers and helpers "Famous Chollima."
The US says North Korea uses overseas IT workers to earn cash and dodge sanctions. John Eisenberg, Assistant Attorney General for National Security, said the regime raises money this way for illicit purposes, including weapons that could one day threaten the US and its allies.
The full operation dwarfs the case involving 70 American companies. Officials cited in the Texas investigation say the US Treasury estimated North Korean IT workers earned more than $800 million (£603.14 million) for the regime in fiscal year 2024. That covers the whole IT-worker network, not just the laptop farms raided this time.
The State Department is also offering up to $5 million (£3.77 million) in rewards to help stop North Korea dirty money trail, from cybercrime to money laundering and sanctions evasion.
Remote Hiring Just Got Riskier
The big challenge for companies hiring online is proving that the person on screen is real and is working from where they claim.
Remote hiring opens up global talent, but weak checks make identity fraud easier. Here, investigators say ordinary homes became a key link between fake job applications, US company equipment and money sent to North Korean-controlled entities.
Two US nationals were arrested in a related Ohio case on charges of wire fraud, money laundering and identity theft. The Justice Department said 14 people were involved in the wider prosecution.
The lesson is uncomfortable: a computer sitting in an American home can make an overseas employee appear to be just like a local.
