Operation details
The FBI, with support from CrowdStrike, shut down more than 40 North Korean laptop farms in the U.S. Over 200 devices were seized in the operation in Texas. According to The New York Times, authorities chose to take down the network as soon as possible rather than wait for prosecutors to file charges, which is why no arrests have been made yet.
How the fake worker scheme works
North Korea generates income through fake remote workers despite economic sanctions. In this setup, facilitators based in the U.S. host the work laptops that companies send to the fraudulent workers, making it appear as if they are based in the country. The scheme is reported to earn around $500 million a year, affecting both startups and Fortune 500 companies.
How one infiltrator was caught
Amazon's IT department caught one North Korean infiltrator after noticing a 110ms keyboard input lag, which betrayed the person's distant location.
Past operations and legal action
The U.S. has been cracking down on the scheme since last year. It previously shut down 29 North Korean laptop farms across 16 states that were facilitating the employment of North Korean IT workers at over a hundred U.S. companies. In November 2025, four U.S. citizens and a Ukrainian national were convicted over similar scams. The Justice Department recently unsealed indictments against two U.S. citizens and 10 China-based North Koreans; prosecutors said the group defrauded more than $3 million from 70 companies over six years starting in 2019.
The problem is growing
Adam Meyers, who leads CrowdStrike's counter adversary operations, says the scheme is "increasing both in prevalence and complexity." He noted the company identified an average of two new cases daily last month, but that this is most likely just the tip of the iceberg. According to Meyers, facilitators are the crucial aspect these operations rely on; what looks like easy money at first becomes increasingly complicated as the operation progresses.
