North Korean IT-worker schemes are not ordinary résumé fraud. They combine stolen identities, fabricated work histories, proxy locations, U.S.-based laptop hosts, remote-access tools and legitimate employment to generate revenue for the DPRK and, in some cases, obtain access to source code, cloud systems, credentials and financial assets. The FBI now reports cases involving repository theft, session-cookie harvesting and extortion—not merely undisclosed nationality.
For employers, the practical answer is a connected control system: verify the person and claimed location, control the device, limit privileges, monitor data movement and preserve evidence if something looks wrong. A single background check or video interview is not enough.
What “North Korean IT workers” means
U.S. government advisories describe skilled developers, freelancers, contractors and other technical workers dispatched or managed by DPRK-linked organizations. Their work can include software, mobile applications, websites, databases, artificial intelligence, hardware, firmware, gaming, animation and virtual-currency projects. A worker may initially perform ordinary duties rather than launch malware.
That apparent normality is the risk. The employment can support prohibited DPRK revenue generation, violate sanctions, or give a later intruder a trusted position inside the company. The issue is not ethnicity or nationality; it is whether identity, location, affiliations, payment flows and access have been truthfully and lawfully established.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
The 2022 U.S. advisory said thousands of DPRK IT workers operated overseas or from North Korea and that some individual workers could earn more than $300,000 annually, with teams earning more than $3 million annually. Those are official advisory-era estimates, not an independently audited current census or average wage. Read the joint U.S. advisory.
Why the threat has expanded
The operation serves three overlapping purposes:
- Foreign-currency generation: technology contracts provide access to high-paying global work despite sanctions.
- Sanctions evasion: stolen identities, third-country intermediaries, proxy companies, payment platforms and cryptocurrency obscure who earned and received the money.
- Access: employment can expose source code, cloud consoles, credentials, customer information, export-controlled technology and financial systems.
The documented progression is more important than an unverified annual growth percentage. The May 16, 2022 advisory described a large-scale revenue and sanctions-evasion system. On January 23, 2025, the FBI reported code copying, credential and session-cookie theft and extortion. A July 2025 Justice Department case alleged more than 80 compromised U.S. identities, jobs at more than 100 companies and at least $3 million in company damages and losses. On March 12, 2026, Treasury sanctioned facilitators in the DPRK, Vietnam, Laos and Spain and described one facilitator converting approximately $2.5 million into cryptocurrency between mid-2023 and mid-2025, including IT-worker earnings.
- FBI/IC3 alert, January 23, 2025
- DOJ announcement, July 2025
- Treasury sanctions action, March 12, 2026
How the scheme works
- Identity acquisition: operators steal, buy or borrow identities, platform accounts and identity documents. Non-North Korean facilitators may create accounts and later transfer control.
- Reputation building: they assemble résumés, portfolios, websites, references, social profiles and invoices using plausible technical histories and sometimes real names or company details.
- Location masking: VPNs, virtual private servers, remote desktops, proxy accounts, intermediaries and U.S.-based “laptop farms” make an overseas operator appear to work from the claimed country. A U.S. host may receive the employer’s laptop and install unauthorized remote-access software.
- Hiring: the applicant may pass résumé screening, interviews, identity checks, drug tests, staffing-agency onboarding or freelance-platform controls. The FBI has warned that artificial intelligence and face-swapping can be used in video interviews.
- Access expansion: once hired, the worker may seek repositories, CI/CD systems, secrets, identity providers, VPNs, production environments, finance tools or customer data beyond the role’s needs.
- Monetization or exploitation: salary may be routed through intermediaries or converted to cryptocurrency. In reported cases, workers or collaborators copied repositories, stole credentials and session cookies, supported further intrusions or threatened to publish stolen code.
How this differs from ordinary insider risk
| Conventional insider risk | DPRK IT-worker scheme |
|---|---|
| The employee’s identity is usually genuine. | Identity, location, résumé and work history may all be false. |
| The employee may act alone for personal gain. | The worker can be part of a managed, state-linked revenue and facilitation network. |
| Risk begins after hiring. | Fraud begins during recruiting and can continue through employment. |
| The employee normally controls the assigned device. | A third party may physically host the company laptop while an overseas operator uses it. |
| Termination may end the immediate risk. | Copied data, stolen credentials, tokens and shared accounts can persist. |
The control lesson is to treat hiring verification, device custody, identity assurance and least privilege as one system—not separate HR and security tasks.
Red flags by stage
Application and interview
- Mismatched name, location, nationality, education, employment history or contact details.
- Identical résumé language, phone numbers, email addresses, portfolio text or references across applicants.
- Sparse or generic portfolios, unverifiable employers or universities, or requests to move communications off-platform.
- Inconsistent explanations of time zone, location or career history.
- Artificial-looking video, unusual interview artifacts or answers that do not match the claimed experience.
Onboarding and payment
- A request to ship equipment to an address that does not independently match the identity.
- Changes to bank details, payment accounts, address or identity information.
- Requests for cryptocurrency or for payment through another person’s account.
- Refusal to complete lawful live-video, device or identity-verification steps.
- A staffing vendor that will not explain its verification, subcontractor or incident-notification process.
Device, network and work behavior
- Logins from geographically inconsistent countries or rapid country changes.
- Unapproved VPN, VPS, RDP or remote-control software.
- Multiple people apparently using one endpoint, or simultaneous calls from the assigned device.
- Repository cloning, browser-session anomalies, private-cloud uploads or code copied to personal accounts.
- Access to systems unrelated to the job, unusual downloads, small unexplained transactions or recommendations to hire additional contractors.
A red flag is a reason for additional, lawful verification—not proof of DPRK affiliation. Legitimate travel, corporate gateways, VPNs, distributed teams and unusual schedules can create false positives.
Defensive controls before hiring
- Verify identity repeatedly: use more than one document or video interaction, and connect verification to account provisioning.
- Independently verify education and employment: use contact information obtained from trusted institutional or business sources, not only the résumé.
- Cross-check applicants: compare phone numbers, email addresses, portfolio language, references and identity attributes for reuse.
- Confirm the claimed location: reconcile identity records, payroll, shipping, time-zone behavior and authentication telemetry.
- Use live, role-specific interviews: ask follow-up questions requiring detailed familiarity with the claimed work.
- Apply lawful checks: review privacy, biometric, employment, drug-testing and anti-discrimination rules in each jurisdiction.
- Audit vendors: require staffing and freelance providers to document identity verification, sanctions screening, device controls and incident notification.
- Control logistics: independently confirm the recipient and address before shipping hardware.
- Do not pay ordinary employees or contractors in cryptocurrency.
The official guidance recommends video verification, appropriate biometric or fingerprint login, banking checks and direct education and employment verification. These measures must be implemented proportionately and lawfully. See the advisory’s mitigation guidance.
Controls after hiring
- Issue company-managed devices, enroll them in endpoint management and remove local administrator rights.
- Block or strictly approve remote-desktop tools; use allowlists and retain logs instead of banning legitimate support categorically.
- Require phishing-resistant, device-bound MFA for privileged access.
- Separate development, production, finance, identity administration, secrets management and export-controlled systems.
- Use short-lived credentials and just-in-time elevation for sensitive work.
- Monitor repository cloning, cloud uploads, browser sessions, private repositories, unusual transfers and impossible-travel events.
- Revalidate contractor identity and device custody periodically, not only at hiring.
- Maintain auditable records of onboarding, equipment assignment, approvals and access changes.
Virtual development environments, browser isolation and supervised offices can reduce local export of source code, although they may create developer-tool and usability trade-offs. Broad permanent administrator access is difficult to justify for most roles.
Rank #3
If a suspected worker is already inside
Containment should preserve evidence and avoid an improvised confrontation.
- Notify incident response, legal, HR, security leadership and the relevant executive.
- Preserve endpoint images, identity documents, payroll and shipping records, email, chat, authentication logs, repository history and cloud activity.
- Do not delete the account or wipe the device before evidence is secured.
- Revoke sessions and rotate passwords, API keys, SSH keys, tokens, cloud credentials and remote-access permissions in a controlled sequence.
- Isolate the device while preserving volatile evidence.
- Review source-code repositories, private cloud storage, browser sessions, finance systems and export-controlled data.
- Search for related accounts, reused phone numbers, similar résumés, shared addresses and other workers hired through the same channel.
- Assess customer, personal, financial and regulated-data exposure and involve breach counsel where required.
- Report suspected activity promptly to the Internet Crime Complaint Center and consider the local FBI field office, regulators, insurers and data-protection authorities.
Sanctions, liability and worker exploitation
OFAC sanctions can prohibit transactions involving blocked persons and entities, and civil penalties may apply on a strict-liability basis. Exposure can arise through salaries, staffing arrangements, contractors, facilitators and financial intermediaries. Screening is not a substitute for proving who operates the device, where that person is and what access they receive. Consult sanctions counsel before declaring that a specific company or worker violated the law. OFAC’s North Korea sanctions hub lists current program materials.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Criminal allegations must remain attributed to indictments, complaints or agency announcements; allegations are not convictions. Conversely, not every DPRK-linked worker is a willing intelligence operative. The 2022 advisory describes likely forced-labor cases involving excessive hours, surveillance, restricted movement, unsafe conditions and withheld wages. Companies must prevent sanctions evasion and unauthorized access while recognizing that some workers may themselves be coerced or exploited.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What security products can—and cannot—solve
This is not a “North Korean-worker detector” problem. A defensible program layers identity and employment verification, company-controlled hardware, endpoint management, identity governance, least privilege, source-code and cloud monitoring, and incident-response support.
| Capability | Useful for | Limitation |
|---|---|---|
| Endpoint management and detection | Enforcing device policy, detecting unauthorized remote tools and investigating activity. | Cannot prove who is physically operating the laptop. |
| Identity governance | Joiner/mover/leaver workflows, access reviews and privilege reduction. | Does not validate a résumé, location or device custody. |
| Identity and background verification | Document, liveness, employment, education and sanctions checks. | A real person’s identity may still be operated by someone else. |
| Managed detection and response | Correlating endpoint, identity, cloud, network and exfiltration signals. | Requires accurate logs, escalation procedures and preserved evidence. |
For example, Iru advertises workforce identity, endpoint management, endpoint detection and response, vulnerability management and compliance automation, with quote-based pricing and 14-day trials for several products. Iru pricing. Okta Identity Governance advertises lifecycle management, access certification, entitlement management and privileged access; its reviewed product page directs buyers to a trial or sales contact rather than publishing a product-specific price. Okta Identity Governance. Neither category replaces lawful identity checks, staffing-vendor audits or sanctions advice.
Frequently Asked Questions
Are all North Korean IT workers spies?
No. Some perform ordinary technical work. The documented risk is that employment can support DPRK revenue generation, violate sanctions, provide trusted access or later enable data theft and extortion. Some workers may also be subject to coercion or forced labor.
Best Value
Is a VPN proof that a contractor is North Korean?
No. VPNs and unusual locations are investigation triggers only. Legitimate travel, corporate gateways and distributed teams can produce similar signals.
What should a small company do first?
Require independent identity and employment verification, issue managed devices, enforce phishing-resistant MFA, restrict privileges, block unapproved remote-access tools and preserve logs. Escalate suspected activity to counsel and the FBI’s IC3.
The Bottom Line
The strongest defense is a connected control system that verifies who the worker is, where the worker is, which device the worker controls and exactly which systems the worker can access. No single interview, screening vendor or endpoint product can establish all four.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
