U.S. Disrupts North Korean IT Worker Fraud Scheme, Seizes 187 Computers from 40 Laptop Farms

The U.S. Department of Justice (DoJ) on Tuesday announced the disruption of a North Korea-linked fraud operation involving fraudulent remote IT workers. As part of the action, authorities seized approximately 187 computers from over 40 "laptop farms" and charged 14 individuals — a mix of U.S. citizens and Chinese nationals — with wire fraud conspiracy and related offenses.

The indictment alleges the defendants participated in a conspiracy to secure remote employment at more than 70 U.S. companies using stolen résumés and fake identities. The operation, linked to the Democratic People's Republic of Korea, exploited hiring processes and remote work trends to mask the origin of workers and facilitate unauthorized access and activity under false pretenses.

The DoJ action dismantles infrastructure used to support the scheme, including the seized laptop farms. The department emphasized that the operation was not directed at software vulnerabilities but at identity fraud and employment-based deception. Affected organizations are advised to review hiring vetting processes, enforce strict remote access policies, and monitor for suspicious employee activity.