FBI Disrupts North Korean Remote IT Scheme Funding Pyongyang Weapons Program
The FBI dismantled a North Korean network using laptop farms in Texas to secure remote US tech jobs, funding Pyongyang's nuclear program and evading sanctions.
FBI Disrupts North Korean IT Worker Scheme
The Federal Bureau of Investigation dismantled an extensive network of local accomplices last month that helped the North Korean government secure remote technology jobs at American companies. According to The New York Times, the operation involved raiding more than 40 laptop farms across Texas and seizing nearly 200 devices, marking one of the largest efforts by US authorities to block a major revenue channel used by Pyongyang to evade international sanctions and fund its nuclear and ballistic missile programs.
Simultaneously, the US Department of Justice unsealed indictments in Ohio against two American citizens and 10 North Korean nationals operating from China, charging them with identity theft and collecting salaries from unwitting American companies. Prosecutors state that the fraud operated between 2019 and 2025, defrauding more than $3 million from 70 different companies ranging from small startups to massive corporations.
North Korea deploys thousands of state-sponsored IT workers to infiltrate companies in the United States and its allied nations, said Brett Leatherman, head of the FBI's Cyber Division.
The operation was conducted in close collaboration with American cybersecurity firm CrowdStrike as part of the Trump administration's new strategy to deepen partnerships with the private sector to counter cyber threats. Adam Meyers, a senior executive at CrowdStrike, noted that in September alone, an average of two new cases were identified daily, estimating this is merely the tip of the iceberg.
Methods of Operation and Global Reach
The modus operandi relies on stolen American identities purchased on the dark web, alongside artificial intelligence tools to generate fake resumes and pass virtual job interviews. A central pillar of the scam involves American citizens lured by easy money. Accomplices receive laptops sent by companies at their homes and connect them to the network, allowing North Korean operatives to remotely control them and impersonate local employees.
According to The New York Times, the Texas raids did not include arrests of accomplices to enable swift action, though authorities warned them of potential criminal consequences. In past cases, a heavier hand was taken, such as an Arizona resident sentenced to over eight years in prison last year after operating dozens of computers from her home that connected foreign agents to more than 300 companies.
In an official warning, the bureau noted that Pyongyang's methods are growing increasingly sophisticated. Operatives now utilize subcontractors in Pakistan and Nigeria to obscure their tracks, paying Western citizens to appear on camera for them in meetings, verify identities, and even provide urine samples and fingerprints for employment background checks.
