# Two Americans Sentenced for Operating 'Laptop Farms' That Enabled North Korean Employment Fraud at 70 U.S. Companies


In a significant case highlighting vulnerabilities in remote hiring and credential verification, two U.S. nationals have been sentenced to 18 months in prison each for operating sophisticated "laptop farms" that facilitated employment fraud by North Korean IT workers. The operation, which infiltrated nearly 70 American companies, represents a growing threat at the intersection of remote work, supply chain security, and state-sponsored cyber activity.


## The Charges and Sentencing


The two defendants were convicted of conspiracy, wire fraud, and identity theft for their central role in a scheme that generated over $200,000 in fraudulent income funneled to the North Korean regime. The 18-month prison sentences, handed down in federal court, underscore the severity of the operation and its implications for national security and corporate cybersecurity.


While the defendants were U.S. citizens, investigators determined they were knowingly facilitating the employment of North Korean nationals at American companies—a scheme that directly benefited a hostile state and violated U.S. sanctions against North Korea.


## What Are 'Laptop Farms'?


"Laptop farms" are networks of computers strategically positioned to mask the true location and identity of remote workers. In this case, the defendants set up physical locations where North Korean IT workers could access company systems while appearing to log in from legitimate U.S. addresses.


How the scheme operated:


  • North Korean workers were provided with access to computers physically located in the United States
  • These machines used VPN services, proxy servers, and spoofed IP addresses to conceal the workers' true geographic location
  • Login credentials and identity documents were falsified to match fabricated American personas
  • The laptops served as intermediaries, creating the illusion that remote workers were based domestically

    • This technology allowed North Korean nationals to:

  • Bypass geolocation verification systems
  • Circumvent background checks by using false identities
  • Collect paychecks legitimately transferred to the defendants and their associates
  • Maintain employment at target companies for extended periods

    • ## The Scope of the Operation


    The operation's reach was staggering. Investigators identified infiltration at approximately 70 American companies, spanning multiple industries including technology, finance, and healthcare sectors. The defendants' network:


  • Recruited, vetted, and onboarded North Korean IT workers
  • Provided fake identity documentation
  • Managed laptop farm infrastructure
  • Coordinated payroll fraud and money laundering
  • Maintained operational security to avoid detection

    • Affected companies likely employed these workers in roles ranging from software developers to network administrators—positions with potential access to sensitive systems, source code, and internal infrastructure.


    ## The North Korean Connection


    This case is emblematic of North Korea's aggressive state-sponsored cyber program. The regime has long relied on overseas income generation to circumvent international sanctions. Remote employment fraud is one of several methods North Korean operators use to:


  • Generate hard currency for the government
  • Conduct corporate espionage
  • Conduct reconnaissance on U.S. infrastructure
  • Develop technical skills in a globally competitive market
  • Position operatives within target organizations for future cyberattacks

    • Previous investigations have linked North Korean operators to major breaches and cyber incidents, including attacks on Sony Pictures, the 2017 WannaCry ransomware deployment, and SWIFT banking system compromises.


    ## How the Scheme Evaded Detection


    The operation succeeded in part due to gaps in remote hiring and identity verification practices:


    | Detection Bypass | Method |

    |---|---|

    | Geolocation checks | VPN/proxy infrastructure spoofed U.S. locations |

    | Background checks | Fraudulent identity documents with stolen or fabricated information |

    | Behavioral anomalies | Coordinated work schedules designed to mimic normal office hours |

    | Account activity | Legitimate code commits, bug reports, and project work maintained cover |

    | IP reputation | Rotating through commercial VPN services with good track records |


    The defendants' sophistication in operational security—rotating identities, managing multiple laptop farms, and coordinating across dozens of companies—suggests either professional training or guidance from state-level actors.


    ## Implications for American Companies


    This case reveals critical vulnerabilities in corporate security posture:


    1. Remote hiring risks: Companies prioritizing speed-to-hire over due diligence are prime targets for employment fraud

    2. Identity verification failures: Reliance on documentation alone, without multi-factor verification, is insufficient

    3. Geolocation spoofing: VPN detection systems can be circumvented with proper infrastructure

    4. Insider threat exposure: Trusted employee roles with system access remain a high-risk vector

    5. Supply chain contamination: Development teams unknowingly incorporating code from hostile state actors


    Affected companies face potential exposure to intellectual property theft, source code compromise, supply chain attacks, and espionage.


    ## Legal and Regulatory Response


    Federal prosecutors treated this case as a serious threat to national security, invoking:


  • Wire fraud statutes (18 U.S.C. § 1343)
  • Identity theft laws (18 U.S.C. § 1028)
  • Conspiracy charges (18 U.S.C. § 371)
  • Sanctions violations related to prohibited transactions with North Korea

    • The sentencing reflects the intersection of employment law, cybersecurity, and national security enforcement—signaling that federal authorities will aggressively prosecute those facilitating state-sponsored employment fraud.


    ## Recommendations for Organizations


    Organizations must implement layered defenses to prevent similar infiltration:


    Identity Verification:

  • Require government-issued photo ID verification with in-person or video confirmation
  • Conduct multi-stage background checks through multiple vendors
  • Implement continuous identity monitoring post-hire

    • Technical Controls:

  • Deploy VPN detection and geolocation verification at login
  • Implement device-level controls (endpoint detection and response)
  • Monitor for suspicious access patterns and impossible travel scenarios
  • Require hardware security keys for sensitive systems

    • Operational Security:

  • Conduct behavioral profiling for remote workers in sensitive roles
  • Monitor code commits, documentation, and project contributions for anomalies
  • Implement role-based access controls (RBAC) with principle of least privilege
  • Conduct periodic security training on supply chain and insider threat risks

    • Vetting Processes:

  • Expand background checks to include financial, educational, and employment history verification
  • Verify employment references directly through independent channels
  • Conduct video interviews rather than voice-only calls
  • Require multiple forms of identity documentation

    • ## Conclusion


    The sentencing of these two individuals marks an important enforcement action, but the broader threat remains. As remote work becomes the norm and employment marketplaces expand globally, hostile state actors will continue exploiting hiring gaps. Organizations must treat remote employee verification as a critical security function—not a procedural afterthought.


    Companies that remain complacent about hiring practices risk not only fraud and financial loss, but potential compromise of sensitive systems, intellectual property, and competitive advantage. The 70 American companies affected in this case serve as a cautionary tale: due diligence during hiring is far cheaper and less damaging than incident response after state-sponsored actors have established access.