US Justice Department Charges North Korean IT Worker Network Tied to 70 Firms

The indictments reveal a systematic revenue-generation method that U.S. Authorities say channels corporate payroll dollars directly to Pyongyang, testing the limits of remote-work screening across...

The U.S. Justice Department announced on Tuesday a set of coordinated law enforcement actions targeting North Korean remote information technology worker schemes that penetrated more than 70 American companies, according to The Korea Times.

The actions, carried out across Ohio and Texas, included at least one indictment, two arrests, and the seizure of 187 computers, the department said. The Justice Department stated that the schemes generated millions of dollars in revenue that was allegedly linked to the North Korean government.

The North Korean workers in question posed as legitimate remote contractors and obtained employment at U.S.-based firms, according to the department's announcement. By doing so, they received standard corporate compensation that prosecutors say was then funneled back to Pyongyang rather than retained by individual workers.

The seizure of 187 computers suggests investigators focused on so-called laptop farm operations, in which a domestic facilitator hosts multiple machines at a single physical U.S. Address to make overseas workers appear to be located inside the country. The Justice Department has described this technique in prior cases as central to the scheme's ability to pass standard identity verification checks.

The 70-plus affected companies span multiple sectors, though the Justice Department announcement did not publicly name the individual firms as of the date of this report. The full list of affected companies, and whether any face civil liability, has not been disclosed and would require further court filings to establish.

This enforcement action follows a pattern of escalating U.S. Federal attention to North Korean IT infiltration networks. In May 2023, the Justice Department, State Department, and Treasury Department issued a joint advisory warning American businesses that North Korea had dispatched thousands of highly skilled IT workers abroad to earn foreign currency for the regime, in circumvention of U.S. And United Nations sanctions.

The United Nations Panel of Experts on North Korea estimated in a 2024 report that Pyongyang earns up to 600 million dollars annually through overseas IT workers, funds the panel said contribute to the country's weapons programs. That panel's mandate was not renewed by the UN Security Council in March 2024 after Russia vetoed its extension, according to reporting by the Associated Press.

North Korea has not acknowledged the IT worker programs publicly. The country does not maintain diplomatic relations with the United States, and no official Pyongyang response to Tuesday's indictment was available as of publication.

For affected American companies, the enforcement actions raise immediate questions about liability, contract law, and potential sanctions exposure. Under the International Emergency Economic Powers Act, U.S. Persons and companies are prohibited from transactions that benefit the North Korean government. Whether the affected firms face penalties depends in part on what prosecutors determine about their knowledge of the workers' true identities, a question that the ongoing cases have not yet resolved.

The Ohio and Texas jurisdictions named in the announcement are consistent with prior FBI field office activity on North Korean cyber and fraud cases. The FBI field office in Knoxville, Tennessee, and field offices in the Dallas and Cleveland areas have each previously publicized North Korean-linked cyber investigations, though the Justice Department did not specify which field offices led Tuesday's actions.

The full scope of the network, including whether additional indictments are pending and how investigators identified the 70 affected firms, remains unknown. Court documents filed in the Ohio and Texas proceedings, once unsealed, are expected to provide the most detailed public accounting of the scheme's structure and reach.