Justice Department says North Koreans have infiltrated dozens of U.S. companies
U.S. authorities warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached U.S. companies and Pyongyang.
Key points
- DOJ says North Korean hackers used Americans and laptop farms to infiltrate U.S. companies.
- Authorities seized over 180 computers and raided more than 40 laptop farms in Texas.
- At least 70 U.S. companies were infiltrated, generating around $3 million in stolen funds.
The U.S. Department of Justice announced Tuesday that North Korean hackers are increasingly using Americans to help them break into U.S. companies. Prosecutors said they indicted and arrested at least two people and carried out searches at dozens of suspected laptop farms in Texas.
Federal authorities seized more than 180 computers that they believe American companies had shipped to newly hired employees, unaware that the workers were sanctioned North Korean spies using stolen identities of U.S. citizens. The DOJ raided over 40 laptop farms across Texas, the largest disclosed number of homes and residences used to facilitate North Korean hacks, owned by at least two American facilitators.
Scale of the operation
Prosecutors said at least 70 U.S.-based companies were infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies but described them as healthcare, cyber support, retail, communications and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.
Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions.
— the Justice Department
How the scheme works
The Justice Department said North Korean IT workers are increasingly turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers hire facilitators to complete a wider variety of tasks and in some cases subcontract entire jobs to third-party foreign nationals.
North Korean hackers often use real-looking email addresses, spoofed LinkedIn profiles and extensive online and social media accounts as cover. In a separate public service announcement, the FBI said there are thousands of North Korean-state controlled IT workers at Western companies, posing what it called a significant national security and intellectual property theft insider threat.
