{ "id": "308f968b-4345-40c1-8a73-4ab44897b1b9", "created_at": "2026-04-06T00:07:23.521911Z", "updated_at": "2026-04-10T13:13:01.071982Z", "deleted_at": null, "sha1_hash": "b0ad54a600b3b23c13e5665565a79ebfd27eaf33", "title": "DOJ raids 29 ‘laptop farms’ in operation against North Korean IT worker scheme", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 76698, "plain_text": "DOJ raids 29 ‘laptop farms’ in operation against North Korean IT\r\nworker scheme\r\nBy Jonathan Greig\r\nPublished: 2025-06-30 · Archived: 2026-04-05 13:14:15 UTC\r\nNearly 30 “laptop farms” across 16 states have been raided by U.S. law enforcement in recent months for their\r\nsuspected role in a long-running North Korean IT worker scheme. \r\nThe Justice Department on Monday announced a coordinated action that involved three indictments, one arrest,\r\nthe seizure of 29 financial accounts and the shutdown of 21 websites alongside the laptop farm raids. \r\nFBI officials said the laptop farms allowed an undisclosed number of North Koreans to illegally work at more than\r\n100 U.S. companies. The farms host work devices sent by legitimate companies who unwittingly hired North\r\nKoreans, allowing the employees to appear as if they are working from the U.S. \r\nInvestigators have spent years working to stop the scheme, which has seen the North Korean regime earn millions\r\nthrough thousands of people who use fake identities to get hired as IT workers at companies based in the West.\r\nThe FBI said it conducted searches at eight locations in October 2024 across three states that led to the discovery\r\nof more than 70 laptops and remote access devices. \r\nThe FBI conducted 21 more searches in June across 14 states. The locations were not disclosed but FBI offices in\r\nColorado, Missouri and Texas were involved. About 137 laptops were seized as part of the searches. \r\nCourt documents say the North Koreans were helped by multiple people in the U.S., China, United Arab Emirates\r\nand Taiwan. On a call with reporters, the Justice Department did not explain why there were not more arrests\r\nassociated with the raids.\r\nA DOJ spokesperson told Recorded Future News that it is an “ongoing investigation and there could be more\r\narrests or enforcement actions down the line.” \r\nIn at least one case, North Korean IT workers gained access to “sensitive employer data and source code,\r\nincluding International Traffic in Arms Regulations (ITAR) data,” after they were hired by a California-based\r\ndefense contractor that develops artificial intelligence-powered equipment and technologies. \r\nU.S. residents created front companies and fake websites to bolster the credentials of North Korean IT workers\r\nwhile also housing laptops that allowed the workers to remotely access devices provided by the victim\r\ncompanies. \r\nThe Justice Department outlined one situation where workers used fake identities to get hired at an Atlanta-based\r\nblockchain research company before stealing about $740,000 worth of cryptocurrency. \r\nhttps://therecord.media/doj-raids-laptop-farms-crackdown\r\nPage 1 of 4\n\nJohn Eisenberg, assistant attorney general for the DOJ’s National Security Division, said the scheme is designed to\r\nsteal from American companies, evade sanctions and “fund the North Korean regime’s illicit programs, including\r\nits weapons programs.”\r\nFBI Assistant Director Brett Leatherman added that in many cases the North Koreans steal the real identities of\r\nAmerican citizens and warned  residents to be wary of hosting laptop farms on their property. \r\nA ‘massive campaign’\r\nThe Justice Department said it arrested Zhenxing “Danny” Wang, a U.S. national and New Jersey resident now\r\nfacing a five-count indictment. \r\nZhenxing Wang allegedly worked with others to help North Koreans get hired and helped generate $5 million in\r\nrevenue for Pyongyang. The indictment also names six Chinese nationals — Jing Bin Huang, Baoyu Zhou, Tong\r\nYuze, Yongzhe Xu, Ziyou Yuan and Zhenbang Zhou — and two people from Taiwan, Mengting Liu and Enchia\r\nLiu. \r\nFrom 2021 to October 2024, the group allegedly stole the identities of about 80 U.S. citizens and provided them to\r\nNorth Koreans — allowing them to gain employment at several Fortune 500 companies. The court documents\r\nclaim the American companies dealt with about $3 million in losses due to legal fees, network remediation costs\r\nand more. \r\nIn court documents, prosecutors said Zhenxing Wang worked with Kejia Wang, another New Jersey-based U.S.\r\ncitizen, and four others to run the scheme. Kejia Wang traveled in 2023 to Shenyang and Dandong, both of which\r\nare near the border of North Korea and China, to organize the scheme. \r\nZhenxing Wang was allegedly one of several U.S. residents to receive laptops and host them at their homes,\r\nconnecting the laptops to devices investigators called “keyboard-video-mouse or ‘KVM’ switches” that allowed\r\npeople overseas to control them remotely. \r\nZhenxing Wang and Kejia Wang are also accused of setting up shell companies, websites and financial accounts.\r\nKejia Wang transferred millions of dollars to overseas bank accounts and paid people running laptop farms in\r\nCalifornia and elsewhere, the indictments say. \r\nKejia Wang, Zhenxing Wang, and the four other U.S. facilitators were allegedly paid at least $696,000. The FBI\r\nsaid it seized 17 web domains used to facilitate the scheme and 29 financial accounts that held thousands of\r\ndollars.\r\nThe Justice Department did not say whether Kejia Wang has been detained. \r\nA separate indictment charged four North Korean nationals with wire fraud and money laundering. Kim Kwang\r\nJin, Kang Tae Bok, Jong Pong Ju and Chang Nam Il are accused of stealing and then laundering over $900,000 in\r\ncryptocurrency. \r\nAll four are at large, according to the FBI. The indictment said the four traveled to the UAE and used stolen\r\nidentities to get hired by an Atlanta-based cryptocurrency company as well as a virtual token company in Serbia. \r\nhttps://therecord.media/doj-raids-laptop-farms-crackdown\r\nPage 2 of 4\n\nIn 2022, about $175,000 was stolen from the Serbian company in addition to the $740,000 taken from the Atlanta-based company. The men allegedly used Tornado Cash to launder the funds and fake Malaysian IDs to cash out\r\nthe funds. \r\nIn February, an Arizona woman pleaded guilty to running a laptop farm to assist North Korean IT workers. She\r\nfaces nine years in prison. \r\n“North Korea remains intent on funding its weapons programs by defrauding U.S. companies and exploiting\r\nAmerican victims of identity theft, but the FBI is equally intent on disrupting this massive campaign and bringing\r\nits perpetrators to justice,” said FBI Counterintelligence Division Assistant Director Roman Rozhavsky of the FBI\r\nCounterintelligence Division. \r\nNo previous article\r\nNo new articles\r\nJonathan Greig\r\nhttps://therecord.media/doj-raids-laptop-farms-crackdown\r\nPage 3 of 4\n\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since\r\n2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.\r\nHe previously covered cybersecurity at ZDNet and TechRepublic.\r\nSource: https://therecord.media/doj-raids-laptop-farms-crackdown\r\nhttps://therecord.media/doj-raids-laptop-farms-crackdown\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://therecord.media/doj-raids-laptop-farms-crackdown" ], "report_names": [ "doj-raids-laptop-farms-crackdown" ], "threat_actors": [], "ts_created_at": 1775434043, "ts_updated_at": 1775826781, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/b0ad54a600b3b23c13e5665565a79ebfd27eaf33.pdf", "text": "https://archive.orkl.eu/b0ad54a600b3b23c13e5665565a79ebfd27eaf33.txt", "img": "https://archive.orkl.eu/b0ad54a600b3b23c13e5665565a79ebfd27eaf33.jpg" } }