North Korea's Texas Laptop Farms Put Remote Workers Inside 70 U.S. Firms
North Korean government hackers infiltrated at least 70 U.S. companies using laptop farms in Texas run with help from Americans.
On October 13, 2026, the Department of Justice announced coordinated actions against North Korean schemes to place remote information technology (IT) workers inside U.S. firms. Prosecutors indicted and arrested at least two people as part of the operation, according to TechCrunch.
Federal authorities searched dozens of suspected laptop farms across Texas allegedly used to remotely access corporate networks and steal data. Investigators raided more than 40 sites linked to at least two American facilitators and seized more than 180 computers.
Those machines had been shipped by U.S. employers to new hires who were in fact sanctioned North Koreans using stolen identities of U.S. citizens. Once a laptop was powered on and connected inside a U.S. home, the remote operator could log in from abroad. To the employer, the login appeared to come from a domestic internet address and a legitimate company laptop.
The companies were not named. The Department described them as operating in healthcare, cyber support, retail, communications and manufacturing. They were spread across Ohio and 16 other states, including the District of Columbia. The workers generated around $3 million in stolen funds.
Separate indictments unsealed in Ohio charged two U.S. nationals and 10 China-based North Koreans in connection with the IT worker schemes, according to The New York Times. The Justice Department said the October 13 action targeted the North Korean government's effort to fund its regime through remote IT work for U.S. companies.
How the farms worked
The Department warned that hackers working for the North Korean regime are increasingly relying on Americans to facilitate intrusions into U.S. companies. Federal officials described that reliance as operational, not incidental.
The FBI has stated that knowing and unknowing U.S.-based individuals provide a U.S. address where companies can send devices in support of North Korean IT worker schemes. In practice, a facilitator receives laptops, installs remote-access software that lets someone control the machine from afar, keeps the devices switched on, and in some cases handles payroll routing and identity paperwork.
CrowdStrike, which assisted investigators, said laptop farms are vital to North Korea in helping its hackers overcome the physical, financial and legal problems of not being in the United States, according to TechCrunch. Without a domestic presence, sanctioned workers struggle to pass location checks, receive hardware tokens, small physical devices used for login approval, join video calls from expected places, or collect pay through U.S. payroll systems.
The FBI said there are thousands of North Korean state-controlled IT workers operating inside Western companies, posing a significant national security and intellectual property theft insider threat, as described in its October 13 advisory. A hired contractor with valid credentials, virtual private network (VPN) access for secure remote connection, access to source code repositories where software is stored, and ticketing privileges for internal support tasks does not need to exploit a software flaw to get in.
A familiar playbook
The Texas operation follows a series of federal cases using the same methods.
In January 2025, prosecutors indicted two North Korean nationals and three facilitators in a multi-year fraudulent remote IT worker scheme. In June 2025, nine individuals were charged in an alleged scheme to generate revenue for the North Korean government, in which overseas operatives allegedly used stolen identities of American citizens to obtain remote jobs with U.S. companies, including Fortune 500 companies.
In July 2025, an Arizona woman named Chapman was sentenced in connection with a $17 million IT worker fraud scheme. Prosecutors said Chapman helped North Korean IT workers obtain jobs at 309 U.S. companies, including Fortune 500 corporations.
The techniques have been consistent for years. The State Department has said about 130 North Korean workers obtained IT jobs at U.S. companies and nonprofits from 2017 to 2023. North Korean applicants seeking work at Western technology firms used fake names, sham LinkedIn profiles, and counterfeit work papers. Those identities were then paired with U.S. facilitators who provide addresses, receive devices and lend an appearance of domestic employment.
The broader context here is that remote hiring checks have not kept pace with distributed work. Identity proofing for most engineering roles still centers on resumes, video interviews, direct deposit forms and shipment of a managed laptop to a home address. All of those checkpoints can be satisfied with a combination of stolen personally identifiable information and a willing intermediary on U.S. soil.
In my view, hiring and IT operations are now a security boundary in the same way email filtering and endpoint management already are. The controls that matter are pre-hire verification, hardware attestation to confirm a device is genuine and where it is, and behavioral monitoring after access is granted. Valid credentials issued through a compromised hiring pipeline will pass login. Detection shifts to anomalies in work patterns, concurrent logins, refusal to appear on camera, use of remote keyboard video mouse infrastructure that lets a distant user control a local computer, and payment redirection.
What is worth flagging for technology leaders is the insider dimension of these cases. These cases combine revenue generation with potential data theft and extortion. A worker with legitimate access can take source code, customer data or internal documents without setting off perimeter alarms. Containment depends on least privilege, repository logging, data loss prevention and prompt deprovisioning, applied to contractors with the same rigor as full-time staff. I have watched my own children start jobs they never interviewed for in person, and that everyday shift is why this matters. Remote work widened the talent pool for legitimate employers and for state-directed operators. The durable fix is not to retreat from distributed hiring but to make identity assurance and continuous verification routine parts of it.
