Full Breakdown
FBI Disrupts Nationwide “Laptop Farm” Network Supplying North Korea’s Weapons Programs
By Drooid · · How we work
Operation Overview
In a coordinated sweep announced this week, the Federal Bureau of Investigation (FBI) dismantled more than 40 covert “laptop farms” in Texas and seized close to 200 computer devices used to funnel remote information-technology work to the North Korean government. The effort, described as one of the largest to date against the regime’s digital revenue streams, targeted American facilitators who recruited U.S. workers to perform low-pay IT tasks that were then redirected to state-controlled North Korean operators.
Background & Context
U.S. intelligence officials from both the Biden and former Trump administrations have identified the IT-worker scams as a primary source of funding for Pyongyang’s nuclear and ballistic-missile programs, alongside cryptocurrency thefts. The scheme, which began around 2019, involved identity theft to obtain American credentials, allowing North Korean workers to secure contracts with U.S. companies.
Key Figures & Groups
- Brett Leatherman – Head of the FBI’s cyber division, who described the operation as part of the bureau’s newly unveiled cyber strategy emphasizing private-sector collaboration.
- CrowdStrike – The U.S.–based cybersecurity firm that worked with the FBI to identify and disrupt the network.
- U.S. Department of Justice – Unsealed indictments in Ohio against two U.S. nationals and ten China-based North Koreans linked to the identity-theft scheme.
Data & Statistics
- Over 40 laptop farms dismantled across Texas.
- Approximately 200 computer devices seized.
- The indictment alleges the scheme defrauded 70 companies of more than $3 million.
- The fraudulent activity operated from 2019 through 2025.
- Two additional defendants remain under seal.
Official Statements & Responses
He noted that the FBI’s new cyber strategy, announced last month, aims to work more closely with private firms to pre-emptively strike malicious actors. The Justice Department highlighted the indictments as a continuation of a broader campaign to cut off North Korea’s “stealthy and evolving digital threat,” which officials say remains “likely vast” despite limited public data on its full scale.
The operation underscores ongoing U.S. efforts to disrupt financial channels that enable North Korea to evade international sanctions and sustain its weapons development.