The U.S. Department of Justice has confirmed that North Korean hackers are increasingly outsourcing their day jobs to Americans, which is either alarming national security news or a grimly logical extension of the gig economy, depending on your mood.

In an announcement on Tuesday, prosecutors said they have indicted and arrested at least two people and conducted searches across dozens of suspected "laptop farms" in Texas. These are exactly what they sound like: rooms full of computers, allegedly used by North Koreans to remotely hack into American companies and steal sensitive data while everyone assumed they were just very dedicated remote workers.

According to the DOJ, federal authorities seized over 180 computers that American companies had helpfully shipped out to their newly hired employees, not realizing those employees were sanctioned North Korean spies using stolen identities of U.S. citizens. The DOJ raided over 40 laptop farms across Texas - the largest disclosed number of homes and residences used to facilitate North Korean hacks - owned by at least two American facilitators, who presumably thought they were just running a very unusual co-working space.

CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said laptop farms are "vital" to North Korea in helping its hackers overcome the physical, financial, and legal challenges of not actually being in the United States. A hurdle most people solve by simply not applying for the job.

Prosecutors said at least 70 U.S.-based companies had been infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies, but described them as operating in the healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.

"Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions," the Justice Department said. "These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals." So yes, the hacking industry now has middle management.

Oftentimes, North Korean hackers use real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts as cover for their activities - a technique that works because it is essentially identical to what every other job applicant does.

In a separate public service announcement, the FBI said there are "thousands" of North Korean state-controlled IT workers employed at Western companies, which "pose a significant national security and intellectual property theft insider threat." Thousands. At this point it might be faster to list the companies that haven't been infiltrated.

This is the latest wave of arrests, indictments, and enforcement action targeting North Korean activities in the United States in recent years. The breakaway regime has used this "remote IT workers" scheme to let North Koreans gain employment with U.S. and European companies, earn a wage, and then steal sensitive information and intellectual property while employed. The victim companies are then extorted into paying the hackers further - a business model that combines payroll fraud, espionage, and ransomware into one conveniently bundled package.

The remote IT workers' scheme is one of several strands of illicit revenue the North Korean regime aims to generate, including hacking crypto exchanges and open-source developer projects, all with the aim of funding its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025 alone, which is a lot of money to lose to a country that reportedly can't keep the lights on.

Experts on North Korea have put the number of hacked companies and the amount of stolen crypto as likely much higher than reported, because of course they have.

Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind around half of all documented "hands-on-keyboard" intrusions over the past year - referring to hacks carried out by humans and not automated tools or AI, which is either reassuring or deeply concerning depending on how you feel about AI's career prospects.