Workers used stolen or fake U.S. identities to secure employment, funneling millions of dollars to the North Korean government.

“These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs,” Assistant Attorney General John Eisenberg, the head of the Justice Department’s National Security Division, said in a statement.

Justice Department charged four North Koreans with posing as IT workers to steal U.S. companies money, it said Monday.

The U.S. Department of Justice and FBI on Monday announced an arrest and indictments targeting North Korea’s so-called “IT worker” program, where North Koreans obtain remote IT-related positions at more than 100 U.

U.S. Attorneys from Massachusetts and Georgia alleged that North Korean actors were given remote access to some 100 U.S. companies under false IDs.

Two indictments, one arrest, and other actions across 16 states puts a dent in the illicit remote work schemes targeting US companies.

The coordinated action saw searches of 21 known or suspected "laptop farms" between June 10 and 17, 2025, across 14 states in the U.S. that were put to use by North Korean IT workers to remotely connect to victim networks via company-provided laptop computers.