For years, the North Korean government has deployed technically skilled workers abroad and online to obtain employment with Western companies while concealing their identities, nationality, and true location. They use stolen or fabricated identities, false employment histories, proxy infrastructure, U.S.-based facilitators, and increasingly sophisticated methods to fraudulently obtain remote work positions.

The main objective of this activity is to generate money for government coffers. Since North Korea is heavily sanctioned, it uses these workers to generate income to support the regime. The U.S. government assesses substantial portions of these earnings are used to support national priorities, including weapons of mass destruction and ballistic missile programs.

A 2024 United Nations Panel of Experts estimate cited by the U.S. Department of Justice assessed that approximately 3,000 North Korean IT workers were operating overseas, with another 1,000 working from inside North Korea, generating an estimated $250 million to $600 million annually for the regime.

Tech companies remain the most visible targets, particularly those hiring remote software developers. However, tech companies are only about half of the targeted organizations. North Korea targets a wide array of industries, including finance, healthcare, and professional services.

A company's industry does not define the risk exposure. Rather, a combination of remote hiring, inadequate identity verification, and potentially insufficient monitoring of employee activity increases the risk of falling victim to this scheme. North Korea is taking advantage of a hiring system which has evolved over decades with no consideration for this type of risk. The days of only conducting I-9 verifications are over.

To examine this threat, Blue Lantern Advisory and OUTFOXM bring together complementary perspectives on investigative capacity building and organizational cyber readiness. Together, we examine how organizations can prevent and detect fraudulent remote workers, as well as prepare for the possibility that one successfully gains access.

How the Scheme Works

North Korea's remote worker strategy relies less on technical intrusion than on deception. North Korean workers seek employment while concealing their nationality, location and affiliations with the assistance of U.S.-based facilitators.

They commonly use stolen or fabricated identities, falsified resumes and credentials as well as fake social media profiles and online portfolios to present themselves as U.S. or non-North Korean workers. In some cases they use U.S.-based facilitators to establish domestic internet connections, create bank accounts, and receive company-issued laptops. A single worker may operate multiple identities, while identities and accounts may also be shared among members of a team.

The Role of U.S.-Based Facilitators

U.S.-based facilitators help North Korea's workers overcome one of the scheme's central challenges: making an overseas worker appear to be physically located in the United States. Facilitators may receive company-issued laptops at U.S. addresses, connect those devices to remote-access hardware or software, and provide domestic internet infrastructure that allows overseas workers to access employer networks while appearing U.S.-based. Some also establish bank accounts, create job-platform accounts or front businesses, receive payroll funds, reship equipment overseas, or participate in employer screening and interviews.

These arrangements, sometimes described as "laptop farms," can defeat controls intended to identify foreign applicants or block overseas access. Recent Department of Justice cases demonstrate that facilitators have supported North Korean workers across hundreds of U.S. companies, providing the physical and financial infrastructure needed to sustain fraudulent employment and transfer proceeds overseas.

Traditional practices are not sufficient to detect this style of fraud in the recruitment process. Organizations should treat identity verification as part of an investigative process rather than an administrative check.

Candidate Vetting

Organizations should:

During Interviews

Fraudulent candidates may perform well during an interview. The candidate may possess the required technical skills and speak fluent English, or use artificial intelligence to assist with the language barrier. Interviewers should not exclusively focus on technical competencies, but holistically confirm whether the candidate is who they claim to be. Remote interviews should include identity verification measures.

Organizations should consider:

Case Study: Creative Interviewing at Kraken

When cryptocurrency exchange Kraken suspected a software engineering applicant was a North Korean operative, its security team used creative interviewing techniques to test whether his claimed background was genuine. The applicant said he had attended New York University and lived in Houston. During an interview scheduled on Halloween, he appeared unfamiliar with basic Halloween traditions and could not answer simple questions about restaurants or daily life in Houston. The exercise demonstrated how conversational questions about local culture and personal experience can expose inconsistencies that technical interviews and résumé reviews may miss.

During Onboarding

Verification should not end once a job offer is extended to the candidate. Additional indicators of fraudulent candidates can manifest during the onboarding process.

Organizations should:

During Employment

Once hired, the employee may perform enough legitimate work to maintain employment and continue receiving a salary. While the employee may present as genuinely productive, behind the scenes they may use artificial intelligence tools, rely on third-party facilitators, or subcontract portions of their work to other individuals to help sustain the deception and meet job requirements. Wages are ultimately transferred through intermediaries to the North Korean regime.

The greatest security concern begins after hiring, because the employee, who has entered through legitimate channels, may voluntarily be granted credentials, company devices, network access and other sensitive resources. In effect, the scheme converts a fraudulent applicant into a trusted insider.

Organizations should:

Case Study: Endpoint Security Discovery at KnowBe4

In 2024, cybersecurity company KnowBe4 inadvertently hired a North Korean IT worker as a software engineer after the candidate passed multiple video interviews, reference checks, and a background check using a stolen U.S. identity. The deception was discovered only after the employee received a company laptop and attempted to execute unauthorized software and transfer potentially malicious files. Endpoint security alerted KnowBe4's security operations center, which contained the device within approximately 25 minutes. A subsequent investigation involving the FBI identified the employee as a North Korean IT worker. No company or customer data was compromised.

No individual control is sufficient if recruiters, hiring managers, onboarding personnel, and security teams do not understand the threat they are trying to detect. Organizations should train personnel involved in hiring and onboarding to recognize common indicators associated with the North Korean remote worker scheme, understand when inconsistencies warrant additional scrutiny, and know how to escalate concerns to security or legal personnel. Training should emphasize that no single indicator is determinative. The objective is to identify patterns of inconsistency that may justify further verification.

Preparing for Controls to Fail

No mitigation plan is one hundred percent foolproof. Therefore, in addition to the steps above, we also recommend all organizations make a concerted effort to plan for the worst. That is, plan for a scenario in which a malicious remote worker is hired and granted access to your networks and systems, despite best efforts to prevent it. These individuals, and the nation states often behind them, are skilled at manipulation, impersonation and espionage, and only have to succeed once.

The recommendations that follow all center around predetermining key response actions and responsibilities so that in a real-world emergency, much of the hard work is already done.

Conclusion

The central lesson is straightforward: identity verification does not end when an employee is hired.

Organizations that hire remote workers should independently validate identity and history, test inconsistencies during interviews, scrutinize changes during onboarding, limit access after hiring, and continue verifying that the person using company credentials is the person the organization intended to hire.

But even strong preventative and detection measures can fail. Organizations should also prepare for the possibility that a fraudulent worker compromises the system by deciding key roles and decision authorities ahead of time, and rehearse realistic scenarios. The goal is not only to reduce the likelihood of a bad actor gaining access, but to ensure the organization is ready if one does.