logo

DoJ Disrupts North Korean IT Worker Scheme Across Multiple US States

ID: d4864920-0a67-5dba-9f66-cc61d1d362d5

STIX ID: report--d4864920-0a67-5dba-9f66-cc61d1d362d5

Feed Name: Dark Reading

Threat Score
75/100

Date Published: 2025-07-01

Date Updated: 2026-04-21

Author: Kristina Beek

...
...

The U.S. Department of Justice disrupted a multi-year DPRK-linked scheme that used stolen or fake identities to place North Korean operatives as remote IT workers at U.S. companies. Investigators identified 29 laptop farms across 16 states, seized financial accounts and websites, and arrested/indicted multiple individuals; the campaign generated over $5M in revenue and included thefts of virtual currency (~$900k), theft of sensitive employer information, and laundering to fund North Korean illicit programs.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.