EDITION OF OCTOBER 14, 2026
North Korean infiltrations: US authorities target local facilitators
According to the US Department of Justice, at least 70 companies were infiltrated by North Korean workers using stolen identities. The seizures in Texas highlight the alleged role of US facilitators in these remote operations.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Computers delivered to new recruits allegedly served as access points for North Korean operators working remotely. The operation described by US authorities puts local intermediaries and identity verification at the forefront, where recruitment and IT security meet.
The US Department of Justice describes a new operation against corporate infiltrations attributed to North Korean workers. According to prosecutors cited by TechCrunch, at least 70 US companies were affected. Authorities announced the indictment and arrest of at least two people, along with searches at more than 40 sites in Texas allegedly serving as computer relay locations.
According to the department, the scheme relies on a separation between the identity of the employee hired and the person actually using their workstation. North Korean nationals allegedly obtained jobs using stolen identities of US citizens. The companies then allegedly shipped computers intended for their new recruits to locations that allowed them to be used remotely. Authorities say they seized more than 180 computers as part of this operation.
These installations, often referred to as laptop farms, would give operators a physical presence in the United States without requiring them to be there. CrowdStrike, which says it helped the FBI investigate and disrupt the operations, highlights their role in overcoming the physical, financial and legal obstacles associated with that absence. The department says the workers involved are increasingly seeking US facilitators in response to improved detection by private companies and action by authorities.
The targeted companies are not named. The department cites sectors including healthcare, cybersecurity services, commerce, communications and manufacturing. Prosecutors estimate the stolen funds at around $3 million. These details remain statements by authorities reported by TechCrunch: they do not establish, company by company, the nature of the access obtained, the extent of compromised information or the losses actually recorded.
The case suggests that recruitment and equipment delivery should be considered components of IT security. If the mechanism described is confirmed, an apparently consistent identity and a computer located in the United States can conceal a remote user who is different from the declared employee. The issue then extends beyond detecting malware alone: it also concerns the correspondence between identity, employment and the actual use of equipment. The announced searches shed light on this alleged mechanism, without themselves constituting a judicial finding on the responsibility of those arrested.