FBI shuts down over 40 North Korean laptop farms used by fake remote workers

The FBI has dismantled a major North Korean laptop farm operation in the U.S. with the help of CrowdStrike, which assisted in the identification and disruption of these networks. According to The New York Times, the agency shut down over 40 laptop farms in Texas, resulting in the seizure of over 200 devices. No arrests have been made so far, as the authorities wanted to take down the operations as soon as possible and did not wait for prosecutors to file charges against those involved, although they also warned that they could face criminal penalties if they continue to be involved with remote fraud.

North Korea has been using fake remote workers to earn income despite the economic sanctions placed against the hermit kingdom. It has been reported that it earns around $500 million a year under this scheme, which affects both startups and Fortune 500 companies. Amazon’s IT department actually caught one North Korean infiltrator after it noticed a 110ms keyboard input lag, betraying their distant location.

The U.S. has been clamping down on this scheme since last year, after it shut down 29 North Korean laptop farms across 16 states that were facilitating the employment of North Korean IT workers across over a hundred U.S. companies. Four U.S. citizens and a Ukrainian national were convicted over scams like this in November 2025, with the Justice Department unsealing indictments against two U.S. citizens and 10 China-based North Koreans recently. Prosecutors said that the last group defrauded more than $3 million from 70 companies over a span of six years from 2019, and that the identities of two more individuals involved in the case remain under seal.

Despite the number of networks that U.S. authorities have been able to shut down since last year, CrowdStrike’s Adam Meyers, who’s in charge of the company’s counter adversary operations, says that this scheme is “increasing both in prevalence and complexity.” He noted that it’s difficult to know how truly widespread the problem is and that even though CrowdStrike has identified an average of two new cases daily last month, it was most probably just the tip of the iceberg.

Facilitators are the one crucial aspect that North Korea’s operations rely on. These are people based in the United States who help bypass security measures by hosting the work laptops that companies send to the fraudulent North Korean IT workers to make it appear as if they’re based in the country. While the job looks like easy money from that start, it would eventually become more complicated as the operation progresses. “They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Meyers told the publication.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.