North Korean laptop farms skim $3M from 70+ US firms
North Korean operators allegedly rented out home laptops to fake remote workers at 70+ U.S. companies, with authorities seizing hundreds of devices in a Texas raid.
The Department of Justice charged 14 individuals in a long-running fraud scheme that used fake remote workers to connect with more than 70 U.S. companies.
The operation relied on “laptop farms,” where work laptops sat in private homes and traffic was routed to conceal North Korean ownership of the funds.
Texas authorities seized about 187 devices during a September raid; the scheme reportedly generated around $3 million between 2019 and mid-2025.
Security researchers say the threat is growing more sophisticated, with attackers leaning on intermediaries to mask the true origin of workers.
Quick read · 1 min
The U.S. Justice Department charged 14 people in a North Korean fraud scheme that used fake remote workers to take salaries from more than 70 U.S. companies. The operation also involved dismantling laptop farms in Texas and seizing about 187 devices. Authorities say the scheme ran from 2019 to mid-2025 and brought in around $3 million for North Korea.
Security researchers warn the threat is evolving. Businesses should tighten onboarding for remote workers, verify identities, and monitor payroll patterns to catch irregular activities early.
What happens next? Legal actions will unfold as prosecutors pursue additional suspects and more details about the network emerge.
The U.S. Department of Justice has charged 14 people in a North Korean fraud network that recruited fake remote workers to siphon salaries from more than 70 American companies. Prosecutors describe a long-running operation that used stolen or counterfeit identities to secure remote roles across health, telecom, cyber support, retail and manufacturing. Domestic facilitators helped host the work laptops at home, open bank accounts, and route payments back to North Korea, according to investigators.
Experts say the scheme ran from 2019 to roughly July 2025 and generated about $3 million in revenue for North Korean groups. A Texas raid in September led to the seizure of about 187 devices and other equipment, underscoring how the operation blended remote work with illicit financial movement.
Officials emphasize that the risk isn’t just monetary. If a company can be tricked into paying someone who seems to be a legitimate U.S. contractor, it creates an opening for broader cyber intrusions or data exposure. Security researchers note the network has evolved to hire intermediaries who help hide the true location of workers and the flow of funds.
For everyday readers, the message is clear: if your employer hires remote workers or contractors, strengthen onboarding, verify identities, and monitor unusual payroll activity. Segmentation of networks and strict controls for devices brought in from outside are key defenses.
01
What exactly is a laptop farm?
In this context, a laptop farm is a group of work laptops kept at private homes that appear to be legitimate U.S.-based employees. Attackers use these devices to access networks or process payroll in a way that hides the real source of payment, routing money back to North Korea.
02
Who was affected, and how wide is the impact?
Prosecutors say more than 70 U.S. companies across several sectors were touched, with victims spanning states including Ohio, Massachusetts, California, New York and Texas. The case illustrates how remote-work fraud can ripple across a large portion of the economy.
03
What can readers do to protect themselves?
Individuals should use strong, unique passwords and enable two-factor authentication on both work and personal accounts. Businesses should tighten vendor onboarding, verify identities, and monitor payroll and access for anomalies. IT teams should also segment networks and watch for remote devices connecting from outside standard corporate environments.
04
What happens next
The Justice Department and FBI say investigations will continue, and more details may emerge as prosecutors pursue additional suspects. Companies and workers should expect further updates as the case unfolds and more evidence comes to light.
A collection of work laptops kept at private homes used to simulate legitimate employees while enabling illicit payments to flow to North Korea.
Who’s charged?
Fourteen people face charges including wire fraud, money laundering and identity theft; some defendants are unnamed or at large.
What should I do now?
For employers, strengthen onboarding and monitor for payroll irregularities. For workers, enable two-factor authentication and be cautious about job offers involving unusual payment structures.
Google expands scam defenses on Android with an opt-in enhanced protection mode that uses Gemini AI to judge unrecognized senders and risky links in Messages.
