Justice Department says North Koreans have infiltrated dozens of U.S. companies

The default method for hiring remote IT staff now carries a significant, undisclosed risk of employing foreign state actors.

The U.S. Department of Justice announced that North Korean hackers have infiltrated at least 70 U.S. companies by recruiting American citizens to act as facilitators. Federal authorities arrested two individuals and raided over 40 "laptop farms" in Texas, seizing more than 180 computers. These "laptop farms" were allegedly used by North Koreans to remotely hack into American businesses and steal sensitive data, generating approximately $3 million in illicit funds. The affected companies span healthcare, cyber support, retail, communications, and manufacturing sectors across multiple states. This operation highlights North Korea's strategy to circumvent detection by using U.S.-based facilitators to overcome physical and legal barriers to conducting cyberattacks. The FBI warned that thousands of North Korean state-controlled IT workers pose a significant insider threat to U.S. companies.

This operation by the Justice Department reveals a sophisticated and escalating tactic by North Korea, moving beyond direct hacking to actively recruiting American intermediaries. The scale of the "laptop farms" and the number of affected companies suggest this is not an isolated incident but a widespread, organized effort. The involvement of cybersecurity firms like CrowdStrike underscores the sophisticated nature of these attacks and the growing challenge for private sector detection and law enforcement.

The DOJ's announcement signals a critical hardening of the cybersecurity landscape for businesses, particularly those reliant on remote workforces or offshore IT talent. Companies may need to implement more rigorous vetting processes for all new hires, especially for IT roles, and re-evaluate their internal security protocols to detect potential insider threats originating from seemingly legitimate employees. The financial and reputational damage from such infiltrations can be substantial, necessitating a proactive approach to security awareness and employee screening.