Loading story…
The U.S. State Department, FBI, and allied governments warned that North Korean IT workers are obtaining freelance and full-time jobs at companies worldwide by using stolen identities, forged documents, proxy interview participants, VPNs, remote desktop tools, and overseas "laptop farms" that make them appear to be operating from trusted jurisdictions. Authorities said the workers funnel wages and cryptocurrency payments back to Pyongyang, helping fund North Korea’s nuclear weapons and ballistic missile programs while exposing employers to insider threats including data exfiltration, credential theft, and cryptocurrency theft.
The warning builds on earlier reporting and government actions showing that DPRK-linked workers have infiltrated Western technology and cryptocurrency firms under false identities, sometimes through front companies and facilitators based in Russia and China. Researchers and prior U.S. cases have tied the scheme to broader risks beyond sanctions exposure, including potential malware deployment, espionage, disruption, and money laundering, prompting officials to urge stronger identity verification, closer scrutiny of interviews and payment arrangements, monitoring for anomalous account activity, and rapid reporting of suspected hires.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Vangelis Stykas publicly disclosed findings from 22 months of access to systems used by North Korean hackers and scam IT workers, saying he found evidence that 1,640 organizations in 57 countries were affected and that 700 to 800 suffered especially damaging intrusions. He said the compromises included root access to servers and AWS environments, exposure of cryptocurrency-related assets, and named victims including Boston Children’s Hospital, Coinbase, Uniswap Labs, Oppo, AEON Smart Technology, Italy’s Supreme Judicial Council, an Al Rajhi Bank subsidiary, and Digitaal Vlaanderen.
On July 31, 2026, the U.S. State Department, FBI, and allied governments issued a joint advisory warning that North Korean IT workers were using stolen identities, forged documents, proxies, and remote-access infrastructure to obtain jobs worldwide. The alert said the scheme funds Pyongyang's nuclear and ballistic missile programs and creates insider-threat risks including data theft, credential compromise, and cryptocurrency theft.
On July 3, 2025, South Korea's Foreign Ministry published a press release announcing a joint advisory related to North Korean IT workers. The release indicates an official government warning about the DPRK IT worker threat prior to the later 2026 U.S.- and allies-led advisory.
On June 30, 2025, the U.S. Department of Justice announced coordinated nationwide actions against North Korean remote IT worker operations, including two indictments, an arrest, a plea agreement, searches of laptop farms, and seizures of financial accounts, websites, and computers. DOJ said the schemes used stolen or fake identities to place workers at more than 100 U.S. companies, generated millions in revenue, and in some cases enabled theft of sensitive data and cryptocurrency.
OpenAI reported banning ChatGPT accounts linked to multiple deceptive employment campaigns that used AI to support fraudulent remote IT job applications. It said the activity was behaviorally consistent with publicly attributed North Korea-linked IT worker schemes and disclosed operational details including automated resume generation, interview assistance, contractor recruitment, and research into remote-access tooling.
On February 1, 2025, OpenAI published a case study on an AI-assisted deceptive employment scheme and said it banned dozens of accounts involved. The activity was described as consistent with publicly reported North Korea-linked IT worker tradecraft, including fake applicant materials, interview assistance, remote-access tooling, and recruitment of U.S.-based helpers to receive laptops or lend identities.
On November 22, 2024, Microsoft published intelligence from its CYBERWARCON presentations describing North Korean IT workers operating under false identities and supported by facilitators providing accounts, banking, SIMs, and job-platform access. Microsoft also said it had found a public repository in October 2024 containing resumes, infrastructure details, playbooks, and evidence of AI-enabled identity fraud and voice-changing experimentation.
North Korea's Foreign Ministry publicly denounced the 11-country advisory on its alleged IT worker schemes, calling the accusations politically motivated and intended to damage the country's image. In a statement carried by KCNA, a spokesperson accused the United States of fabricating a cyber-threat narrative to justify pressure on Pyongyang and deepen confrontation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourceteiss.co.uk
Open sourcenknews.org
Open sourcenknews.org
Open sourceopenai.com
Open sourcemargin.re
Open sourcemicrosoft.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and multiple security firms detailed a large North Korean scheme in which operatives use stolen or fabricated identities to win remote IT jobs at Western companies, then send the earnings back to Pyongyang in violation of sanctions. Research from IBM X-Force, Flare, Microsoft, LevelBlue, and others described a mature ecosystem of recruiters, facilitators, brokers, laptop-farm operators, and Western collaborators that helps workers pass interviews, receive corporate devices, mask their locations with VPNs, and clear payroll and compliance checks. Estimates cited across the reporting say more than 100,000 workers operating across dozens of countries may be generating roughly **$500 million annually**, while some cases also involved data theft, source-code exfiltration, extortion, and malware activity after hiring. The U.S. Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities tied to the operation, while U.S. courts sentenced three Americans, including a former Army soldier, for helping North Korean workers use false identities and laptop farms to obtain jobs at U.S. companies. Investigations also exposed operational tradecraft including use of **Astrill VPN**, **NetKey/OConnect**, **IP Messenger**, freelance platforms, AI-generated resumes and headshots, and U.S.-based hardware relays such as PiKVM-enabled laptop farms; one hired worker was removed within 10 days after suspicious logins from China and Missouri triggered detection. Researchers and federal advisories warned that remote hiring has become an insider-threat and sanctions-compliance risk, urging tighter identity verification, live skills testing, device and geolocation controls, least-privilege access, and joint oversight by HR, recruiters, and security teams.
Jun 30, 2026
Reporting highlighted ongoing **North Korean IT worker** operations in which individuals use **stolen identities, falsified resumes, and AI-enabled deepfakes** to obtain remote roles at Western companies, creating direct insider-risk exposure once hired. The activity was described as affecting **thousands** of workers and **Fortune 500** employers, with claims of "**3,000 hands on keyboards**" and roughly "**30,000 different email addresses**" in use to support multiple personas, generating wages that can total **hundreds of millions of dollars annually** and help fund the North Korean regime. Recommended screening and verification measures focused on practical controls for remote hiring, including prompting candidates to **perform live actions on video** (e.g., wave), validating **IP address/geolocation consistency** with claimed location, and probing discrepancies in a candidate’s stated whereabouts. The reporting framed these checks as necessary to counter identity fraud and synthetic media used to pass interviews and onboarding, and to reduce the likelihood of granting network access to sanctioned or malicious actors operating under false identities.
Jun 29, 2026
North Korean IT workers have significantly expanded their operations to infiltrate a wide range of industries beyond the traditional technology sector, according to research published by Okta Threat Intelligence. The scheme involves North Korean nationals, or individuals funneling money back to Pyongyang, fraudulently obtaining remote employment, primarily in software development roles. Okta's research indicates that nearly half of the targeted companies are outside the IT sector, with finance, healthcare, public administration, and professional services now among the most affected industries. The campaign, which initially focused on U.S.-based cryptocurrency and blockchain firms, has evolved to target organizations in dozens of countries, with 27% of targeted entities now located outside the United States. Okta tracked more than 130 identities associated with North Korean facilitators and workers, linking them to over 6,500 initial job interviews at more than 5,000 companies from 2021 through mid-2025. The methodology for identifying these DPRK-aligned identities relies on a combination of technical indicators, behavioral patterns, and employer reporting, though Okta has withheld some details to avoid alerting the threat actors. The scale of the operation is believed to be much larger than the tracked sample, with the FBI and private security firms, including Google's Mandiant, warning that the problem is widespread among Fortune 500 companies. Mandiant's CTO, Charles Carmakal, noted that almost every CISO of a Fortune 500 company he has spoken to has encountered issues with North Korean IT workers. The North Korean operatives use fake or stolen identities to secure remote roles, circumventing international sanctions and generating millions of dollars for the North Korean military. The campaign's adaptability is evident in its shift to any remote role that fits the scheme's requirements, regardless of industry or geography. Okta's findings highlight the persistent and evolving nature of the threat, with North Korean IT workers now targeting a broad spectrum of organizations globally. The report underscores the need for enhanced identity verification and vigilance in remote hiring processes. The expansion of this scheme poses significant risks to sensitive data, intellectual property, and the integrity of critical sectors such as healthcare and finance. The threat is compounded by the difficulty in detecting these operatives, given their use of sophisticated identity obfuscation techniques. Okta's research suggests that the true scale of North Korean IT worker activity is likely much greater than currently documented. The ongoing campaign demonstrates North Korea's commitment to leveraging cyber-enabled means to generate revenue and evade international restrictions. Organizations are urged to review their remote hiring practices and strengthen controls to mitigate the risk of inadvertently employing North Korean operatives. The findings also highlight the importance of cross-sector collaboration and intelligence sharing to counter this persistent threat. The expansion of North Korean IT worker infiltration represents a significant evolution in state-sponsored cyber-enabled financial operations.
Aug 14, 2026