The FBI just shut down more than 40 fake-worker laptop farms in Texas, seizing over 200 devices tied to North Korea's remote-work fraud scheme.
CrowdStrike helped the FBI identify and disrupt the networks, which let North Korean IT workers pose as US-based remote employees using laptops hosted by local facilitators. No arrests have been made yet. Investigators moved to shut the farms down immediately rather than wait for prosecutors to file charges, though they warned participants could still face criminal penalties. The scheme reportedly nets North Korea around $500 million a year, hitting everything from startups to Fortune 500 companies - Amazon's IT team once caught an infiltrator after noticing a 110ms keyboard lag that gave away their actual location.
This is not a one-off bust. Last year, authorities shut down 29 similar laptop farms across 16 states, and since then prosecutors have convicted four US citizens and a Ukrainian national over related scams, plus unsealed indictments against two more US citizens and 10 China-based North Koreans accused of defrauding over $3 million from 70 companies between 2019 and 2025. CrowdStrike's Adam Meyers says the operation is growing in both scale and sophistication, with his team flagging roughly two new cases a day last month alone - and that is likely an undercount.
The facilitators are the weak link and the recurring theme: ordinary people in the US who take the laptops for easy money and, as Meyers put it, get "in too deep" before they realize what they signed up for. Shutting down farms clearly is not shutting down the scheme.