The FBI has exposed the methods used by a 'North Korean remote IT worker scam' that stole the identities of American citizens to secure jobs, and has dismantled more than 40 laptop farms across Texas.



Thousands of remote IT workers of North Korean origin are stealing American identities to pretend they are not North Koreans, securing employment at companies and organizations across the United States and generating substantial revenue for the North Korean regime. The FBI has released a video explaining their methods.

North Korean IT Workers: A Global Threat - YouTube


North Korean IT Workers: A Global Threat — FBI
https://www.fbi.gov/video-repository/north-korean-it-workers-a-global-threat.mp4/view

Office of Public Affairs | Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 US Companies | United States Department of Justice
https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker

Internet Crime Complaint Center (IC3) | North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
https://www.ic3.gov/PSA/2026/PSA261013

The FBI has described North Korea's remote IT worker scam as a 'global threat.' According to the video, thousands of North Korean remote IT workers around the world have infiltrated companies, generating hundreds of millions of dollars in revenue and sending it back to North Korea. Government officials say the North Korean teams are deceiving companies by using individuals located overseas to participate in job interviews, and in some cases, even arranging direct meetings with company representatives, thereby gaining access to the companies' highly confidential networks. The FBI says the funds sent to North Korea were used for weapons development programs.



North Koreans, by obtaining employment while concealing their identities, are forming an international support network that receives laptops from companies and moves illicit payments across borders. The FBI and its partners have been working to thwart the activities of these networks through coordinated investigations, prosecutions, arrests, asset seizures, and the recovery of illicitly obtained funds.

In fact, in April 2026, two individuals from New Jersey were sentenced to nine years and seven years and eight months in prison, respectively, for running a 'laptop farm' that allowed North Korean IT engineers to pretend to be residents of the United States and work for American companies. The laptop farm operated more than 90 dummy laptops to make it appear as though remote workers hired by companies were working in the United States.

Two US residents sentenced to a combined 16 years in prison for running a 'notebook PC farm' that falsely identified North Korean workers as American workers - GIGAZINE



The FBI says it will work directly with businesses and release actionable information on North Korea alongside its investigations to help organizations identify warning signs and protect their networks, data, and employees. At the same time, it warns employers to monitor suspicious activity during the hiring process and verify the identities of newly hired employees.

The FBI has listed the following four points as a warning to the general public regarding North Korean remote IT worker scams:

• Foreign workers in North Korea often post fake job listings on well-known job websites. These are often presented as freelance work, with simple tasks such as conducting interviews on behalf of others or receiving and storing laptops at home.

Those seeking illegal employment routinely fabricate elaborate stories, establish fake companies, and create official documents to enhance the credibility of their applications. Common claims by illegal workers include being Chinese or East Asian nationals who need a temporary stay in the United States, or being Eastern Europeans forced to flee due to the ongoing Russo-Ukrainian war.

・Refuse any request to provide personal information, financial information, or login information for a personal account in exchange for payment.

Illegal foreign workers use threats of violence and other intimidating tactics to force Americans to continue their illegal activities. If you or someone you know feels their life is in danger or their safety is at risk, please report it immediately.

On October 13, 2026, the Department of Justice's press office also revealed details of the 'Lonestar Roundup,' an operation that identified laptop farms operating in more than 40 locations across Texas, resulting in the indictment of 14 individuals, the arrest of two, and the seizure of approximately 190 devices. Ryan Raybould, U.S. Attorney for the Northern District of Texas, said, 'This investigation is more than just fraud. It's about hostile foreign regimes infiltrating American companies through stolen identities and secret domestic infiltration routes. Every laptop farm we uncover will cut off a source of revenue that the North Korean government uses to fund its weapons development program that threatens global stability. This operation sends a clear message that we will never allow our enemies to exploit American companies or jeopardize national security.'

The Department of Justice said the Lonestar Roundup was centered on close collaboration between private companies and federal law enforcement agencies. CrowdStrike, a cybersecurity firm that assisted in the operation, said, 'We are proud to have worked with the FBI to identify and disrupt U.S.-based laptop farms that North Korean networks use to conceal the identities of their operators, infiltrate organizations, and generate revenue for the North Korean regime. Through threat intelligence and technical analysis, our counter-adversary operations team helped expose the infrastructure that enables these schemes. This is a major step forward in disrupting North Korea's illegal IT worker operations.'




Related Posts:

in Security, Posted by log1e_dh