FBI and DOJ act against North Korean IT worker schemes and US laptop farms
US officials said on 13 October that the FBI disrupted a network of American facilitators helping North Koreans get remote tech jobs, and the Justice Department unsealed Ohio indictments. Coverage differs on whether arrests were made.
1 / 2
The story, neutrally told
Right · 1US officials said on 13 October that the FBI had disrupted, in September, a network of American facilitators accused of helping the North Korean government obtain remote IT jobs that fund its nuclear and ballistic missile programmes. The Straits TimesRC “The FBI in September disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs” Read at The Straits Times ↗ Mixed · 2The operation targeted more than 40 "laptop farms" in Texas; the Straits Times, carrying a New York Times report, says nearly 200 devices were seized, while TechCrunch, citing the Justice Department, says over 180 computers were. The Straits TimesRC “dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices” Read at The Straits Times ↗ TechCrunchN “federal authorities seized over 180 computers” Read at TechCrunch ↗ Right · 1Separately, the Justice Department unsealed indictments in Ohio against two US nationals and 10 China-based North Koreans accused of identity theft to collect pay from US companies, with two more defendants under seal. The Straits TimesRC “unsealed indictments in Ohio on Oct 13 against two US nationals and 10 China-based North Koreans” Read at The Straits Times ↗
Mixed · 2Prosecutors said the scheme affected 70 companies and brought in more than $3 million; the Straits Times says it ran from 2019 to 2025, and TechCrunch says the victims were in sectors including healthcare, retail and manufacturing across Ohio and 16 other states including the District of Columbia. The Straits TimesRC “bilked 70 companies out of more than US$3 million (S$3.84 million) and ran from 2019 to 2025” Read at The Straits Times ↗ TechCrunchN “healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states” Read at TechCrunch ↗ Mixed · 2Accounts differ on arrests: the New York Times report quotes Brett Leatherman, head of the FBI's cyber division, saying the Texas sweep led to no arrests of facilitators, who were instead warned of criminal penalties, whereas TechCrunch says prosecutors indicted and arrested at least two people. The Straits TimesRC “the Texas sweep did not include any arrests of facilitators but that the authorities warned them they could face criminal penalties” Read at The Straits Times ↗ TechCrunchN “they have indicted and arrested at least two people” Read at TechCrunch ↗ Mixed · 2Leatherman said North Korea is deploying thousands of state-controlled IT workers, and an FBI public advisory likewise warned of "thousands" posing an insider threat to Western companies. The Straits TimesRC “thousands of state-controlled IT workers to infiltrate companies in the United States and allied countries” Read at The Straits Times ↗ TechCrunchN “pose a significant national security and intellectual property theft insider threat” Read at TechCrunch ↗
Mixed · 2CrowdStrike helped the FBI identify and disrupt the network; its Adam Meyers said it found an average of two new cases a day in September and that the schemes are increasing in prevalence and complexity. The Straits TimesRC “CrowdStrike identified an average of two new cases per day throughout September” Read at The Straits Times ↗ TechCrunchN “CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations” Read at TechCrunch ↗ Mixed · 2Officials say North Korean workers increasingly pay Americans and other Westerners for tasks such as appearing on camera, attending interviews and verifying identities, and subcontract to people in countries such as Pakistan and Nigeria, and use AI to create fake resumes and photos. The Straits TimesRC “perform a growing variety of identity and location obfuscation tasks” Read at The Straits Times ↗ TechCrunchN “in some cases subcontracting entire jobs to third-party foreign nationals” Read at TechCrunch ↗ Mixed · 2The IT worker schemes are one of several revenue sources for Pyongyang, alongside crypto theft; TechCrunch says the regime is thought to have stolen at least $2 billion in crypto in 2025, and experts say the true scale of both is likely higher than reported. TechCrunchN “The regime is thought to have stolen at least $2 billion in crypto during 2025 alone.” Read at TechCrunch ↗ The Straits TimesRC “whose scale is not entirely clear but likely vast” Read at The Straits Times ↗
Right · 1Leatherman called the Texas action an early example of the FBI's new cyber strategy, unveiled in September, which promises closer work with the private sector. The Straits TimesRC “early example of the FBI’s new cyber strategy, which was unveiled in September” Read at The Straits Times ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left0 outlets
No left outlet in our sources has covered this story yet.
Centre1 outlet
- Framing
- TechCrunch leads with the Justice Department's warning that North Korean hackers are recruiting Americans to facilitate intrusions into US companies, with a hacking and data-theft angle.
- Emphasis
- Data theft, extortion of victim companies, the sectors hit and crypto theft totals.
- Leaves out or plays down
- Does not mention the FBI's statement that no facilitators were arrested in Texas, or the FBI cyber strategy.
- Charged language
- “breakaway regime”“sanctioned North Korean spies”
- For example
-
“hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of U.S. companies” — TechCrunch
“The breakaway regime has used this “remote IT workers” scheme” — TechCrunch
Right1 outlet
- Framing
- The Straits Times, running a New York Times report, frames it as the FBI disrupting a Pyongyang revenue stream that funds weapons programmes.
- Emphasis
- Weapons funding, FBI officials' quotes, the new cyber strategy and why the Texas operation made no arrests.
- Leaves out or plays down
- Gives less detail on affected sectors and states, and does not report any arrests.
- Charged language
- “Pyongyang revenue stream”“stealthy and evolving digital threat”
- For example
-
“Every one of these jobs is funding a stream for a nuclear and ballistic missiles programme” — The Straits Times
“a stealthy and evolving digital threat from North Korea” — The Straits Times
What every side reports
- More than 40 laptop farms in Texas were targeted and roughly 180-200 computers seized.
- About 70 US companies were affected, with more than $3 million at stake.
- CrowdStrike helped the FBI.
- The FBI says thousands of North Korean state-controlled IT workers are active in Western companies.
Where accounts differ
-
Whether arrests were made
- Centre
- TechCrunch says prosecutors indicted and arrested at least two people.
- Right
- The Straits Times (NYT) says the Texas sweep had no arrests of facilitators, who were warned instead; indictments were unsealed in Ohio.
-
Number of devices seized
- Centre
- Over 180 computers.
- Right
- Nearly 200 devices.
FBI organisation
The FBI says North Korea runs thousands of state-controlled IT workers and that the Texas action was meant to move fast to upend the network, warning facilitators rather than arresting them.
“The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges” — The Straits Times
Department of Justice organisation
The Justice Department says North Korean workers increasingly rely on American facilitators to counter better detection and enforcement.
“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions.” — TechCrunch
North Korea place
North Korea is presented as using the schemes to generate cash to evade sanctions and fund weapons; no response from Pyongyang is reported.
“that helped fund the reclusive country’s nuclear and ballistic weapons programmes” — The Straits Times
East and Southeast Asia1 outlet
The Straits Times carries the New York Times report with a revenue-and-weapons-funding angle.
“IT worker scams are a primary method of funding Pyongyang’s weapons programme” — The Straits Times
The Straits Times
North America1 outlet
TechCrunch focuses on the Justice Department's warning about American facilitators and intrusions.
“U.S. authorities warn that sanctioned hackers are increasingly targeting Americans” — TechCrunch
TechCrunch
Left0 articles
No coverage yet.
Centre1 article
-
Justice Department says North Koreans have infiltrated dozens of U.S. companies
Neutral Security-news account of the DOJ announcement stressing American facilitators and hacking of US firms.
Right1 article
-
FBI disrupts Pyongyang revenue stream: North Koreans in US tech jobs
Neutral Detailed New York Times account centred on FBI officials' explanations and the weapons-funding stakes.
- 14 Oct 02:25 First The Straits TimesRC FBI disrupts Pyongyang revenue stream: North Koreans in US tech jobs
- 14 Oct 02:30 +6m TechCrunchN Justice Department says North Koreans have infiltrated dozens of U.S. companies
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…