North Korean operatives allegedly infiltrated more than 70 U.S. companies by securing legitimate remote IT jobs under stolen identities. The scheme generated approximately $3 million in revenue while giving foreign workers access to corporate systems through authorized employee accounts.
On October 13, 2026, the Department of Justice announced charges against 14 individuals and the seizure of nearly 190 devices used to support the operation.
The investigation revealed how fraudulent workers can gain trusted access to corporate systems while concealing their true identities.
The operation relied on a network of suspected “laptop farms” in Texas, where American intermediaries hosted company-issued computers for workers operating overseas. These arrangements allowed North Korean operatives to appear as U.S.-based employees while accessing corporate networks remotely.
According to the FBI and CrowdStrike, the use of domestic facilitators has become an important part of these schemes, helping operatives evade security checks and maintain fraudulent employment.
Why It Matters: Remote work has changed how companies establish trust, yet many security practices still depend on identity checks performed during hiring. North Korea’s scheme exploited that gap by turning legitimate employment into a means of accessing company systems. The investigation raises concerns about how organizations verify who is actually using corporate devices and whether existing security controls can detect an unauthorized operator working through an approved employee account.
- The Hiring Process Became the Point of Entry: North Korean operatives allegedly used stolen identities and fabricated professional histories to obtain remote IT jobs across several U.S. industries. Once hired, they received the same credentials and system access granted to legitimate employees. This allowed unauthorized workers to bypass traditional network defenses and gain access to corporate systems through established hiring procedures.
- Laptop Farms Made Overseas Activity Appear Domestic: Investigators searched more than 40 suspected laptop farms across Texas, where facilitators maintained company-issued computers for remote access by foreign workers. Because the devices remained inside the United States, their network activity could appear consistent with an employee working domestically. The arrangement made it harder for employers to recognize that someone outside the country was controlling equipment they had issued to a verified hire.
- The Operation Depended on a Growing Network of Intermediaries: The DOJ reports that North Korean workers have recruited American facilitators to maintain equipment and support fraudulent employment arrangements. Some operatives have also subcontracted their work to other foreign nationals. CrowdStrike identifies the activity group as Famous Chollima.
- The Financial Damage May Extend Well Past Fraudulent Wages: Prosecutors estimate the scheme generated approximately $3 million, with proceeds believed to have reached North Korean-controlled entities. Access to corporate systems also creates opportunities for intellectual property theft and extortion, activities previously associated with North Korean IT worker operations.
- Employee Verification Cannot End When Onboarding Is Complete: The case raises questions about security practices that treat a successful background check or authenticated device as sufficient proof of identity. Fraudulent workers maintained access through company-issued equipment while concealing who was operating it. The FBI’s updated guidance emphasizes stronger screening and closer examination of suspicious remote-work arrangements. Continued verification of employee activity and tighter oversight of remote-access tools could help companies identify similar operations before they become established inside corporate networks.
Justice Department says North Koreans have infiltrated dozens of US companies – TechCrunch
