The Federal Bureau of Investigation (FBI) has warned that North Korean information technology workers are using stolen identities, fraudulent job applications and US-based intermediaries to gain employment at American companies and access sensitive corporate networks.
In an alert issued on October 13, the FBI’s Internet Crime Complaint Center (IC3) described an evolving operation in which facilitators inside the United States allegedly help North Korean operatives conceal their identities and overseas locations. The arrangements can involve impersonating job applicants, hosting company-issued laptops and assisting with recruitment procedures.
According to the agency, revenue generated through these jobs helps fund the North Korean government, including its weapons and military programmes.
The warning also highlights an escalation beyond employment fraud. Investigators have reported cases involving threats, attempted extortion and demands for additional payments from companies and former employers.
The findings raise concerns for businesses that rely on remote workers, particularly those handling sensitive data, proprietary technology or internal corporate systems.
How North Korean IT Workers Allegedly Enter US Companies
According to the FBI, North Korean operatives are using increasingly sophisticated methods to obtain remote technology jobs while making it appear that they are working from within the United States.
The schemes can involve stolen personal information, forged documents, fabricated employment histories and false explanations of an applicant’s nationality or circumstances.
US-based facilitators allegedly help make these arrangements work. Some are recruited to attend identity-verification appointments, receive company-issued equipment, use their professional networking or social media accounts, or assist with job interviews.
Others may allow their identities or addresses to be used during recruitment and onboarding.
The FBI warned that these activities are illegal and can expose participants to law enforcement scrutiny.
The use of intermediaries creates a significant challenge for employers. A candidate may appear to have a legitimate US location, valid contact information and a functioning work setup even when the person performing the job is operating from another country.
Fraudulent employment can also provide access to internal systems that would otherwise be difficult for an overseas operative to reach.
Americans Under Financial Pressure Are Being Targeted
The FBI said North Korean IT workers are strategically targeting people experiencing financial difficulties, offering money in exchange for help with employment-related activities.
Such requests may initially appear relatively harmless. A person might be asked to receive a laptop, assist with an identity check or use an existing online account. However, these tasks can become part of a larger operation designed to disguise who is actually performing the work.
The agency said some operatives use elaborate personal stories to persuade potential facilitators that their requests are legitimate.
In reported cases, applicants have claimed to be Chinese or other East Asian nationals seeking a temporary presence in the United States. Others have reportedly presented themselves as Eastern Europeans displaced by the Russia-Ukraine war.
These narratives can help explain inconsistencies in an applicant’s background or location while reducing suspicion among people being recruited to assist.
The FBI’s warning underscores the risks of accepting paid requests involving another person’s identity, employment applications or company equipment without understanding the purpose of the arrangement.
Individuals who knowingly participate may face legal consequences, while people whose identities are stolen can become victims of fraud themselves.
What Are Laptop Farms, and How Do They Work?
One of the methods highlighted in the alert involves so-called laptop farms, in which US-based facilitators host computers supplied by employers.
Under this arrangement, a company sends a work laptop to an address in the United States. The device remains physically located there, but the person using it remotely may be operating from outside the country.
The setup can make it appear that the employee is working domestically, even when the person accessing company systems is elsewhere.
Facilitators may be paid to receive equipment, keep computers connected to the internet and maintain the appearance of a normal remote-work arrangement.
According to the FBI, these operations have existed for years, but operators are spreading devices across multiple locations to reduce the risk that a single disruption will affect the wider network.
For employers, the problem extends beyond verifying a mailing address. A laptop physically located in the United States does not necessarily establish the identity or location of the person controlling it.
The arrangements can also complicate investigations because equipment, accounts and network connections may appear to belong to legitimate employees or US-based households.
Freelancers in India, Pakistan and Nigeria Also Feature in the Schemes
The FBI reported that some North Korean IT workers are subcontracting portions of their assignments to freelancers in other countries, including India, Pakistan and Nigeria.
Other individuals are reportedly hired to submit job applications or participate in interviews on behalf of the actual workers.
These arrangements can create several layers between the company and the person ultimately carrying out the work. An employer may recruit one individual, communicate with another and receive deliverables partly produced by someone else.
The mention of freelancers in these countries does not mean that freelance workers generally are involved in North Korean operations. The concern relates to individuals allegedly recruited to conceal the identity, location or role of the person behind a fraudulent employment arrangement.
Companies may therefore need to understand not only who has been hired, but also who is accessing their systems and whether the work is being performed by the person authorised to do it.
This is particularly important when contracts restrict subcontracting or when employees have access to confidential source code, customer records, financial information or other sensitive assets.
FBI Warns of Threats and Extortion Against Companies
The FBI’s alert describes a more serious development: alleged intimidation and extortion involving former employers and other people connected to the schemes.
According to the agency, some North Korean IT workers have threatened former managers and their families after being dismissed, demanding additional payments.
Other reported cases involve threats to release confidential corporate information, publish proprietary material or damage a company’s reputation unless large sums are paid.
The FBI also described incidents in which US-based facilitators were allegedly sent to intimidate companies or people hosting laptop farms.
These tactics can turn what initially appears to be employment fraud into a broader security and financial threat.
Companies may face pressure to pay in order to prevent sensitive information from being disclosed. Former employees or facilitators may also find themselves exposed to threats after a working arrangement ends.
The alert does not mean every suspected fraudulent employee will engage in extortion. Rather, it identifies coercion as a risk that employers and individuals should consider when dealing with these operations.
Businesses that encounter threats should preserve relevant communications, restrict unauthorised access where appropriate and report suspected criminal activity to the relevant authorities.
Stolen Identities Create Risks for Employees and Businesses
Stolen personal information remains central to the alleged schemes, according to the FBI.
Operatives may use another person’s identity to apply for work, complete verification procedures or establish an apparently legitimate professional profile. Once hired, they may gain access to personal information and internal corporate data through their employment.
The FBI also reported cases in which people whose identities had been stolen were contacted and threatened.
This creates two distinct categories of potential victims. Companies may face unauthorised access, data exposure and financial losses, while the individuals whose identities were misused may experience reputational damage, employment difficulties or intimidation.
Employers must therefore avoid assuming that every suspicious application represents deliberate wrongdoing by the person whose name appears on it. A genuine applicant’s identity may have been stolen or misused without their knowledge.
The FBI cautioned against relying on a single warning sign to identify fraudulent candidates. Instead, employers should assess multiple indicators and establish whether inconsistencies can be explained.
How Companies Can Reduce the Risk
The FBI has urged employers to strengthen recruitment procedures and coordinate security efforts across departments.
A more comprehensive approach can help organisations identify suspicious patterns without treating every remote applicant as a potential threat.
Recommended precautions include:
- Verify applicants’ identities using reliable, independently confirmed documentation and procedures.
- Check whether a candidate’s employment history, professional credentials and stated location are consistent.
- Use appropriate access controls so employees receive only the permissions necessary for their roles.
- Monitor account activity and access patterns for signs of unauthorised use, subject to applicable privacy and employment laws.
- Coordinate human resources, IT, cybersecurity, legal and management teams when evaluating suspected employment fraud.
- Establish clear rules governing the receipt, storage and use of company-issued equipment.
- Maintain procedures for reporting suspected identity theft, unauthorised access, threats and extortion.
The agency also warned against overly broad screening practices that could unfairly exclude legitimate applicants or harm people whose identities have been stolen.
Effective security requires evidence-based checks rather than assumptions about nationality, location or background. Companies should investigate inconsistencies fairly and apply safeguards consistently.
Why the Warning Matters for Remote Work and Cybersecurity
Remote hiring has enabled companies to recruit skilled workers across borders, but it also creates opportunities for people to misrepresent their identities or locations.
The FBI’s alert illustrates how employment fraud can become a route into corporate networks. Instead of relying exclusively on conventional cyberattacks, an operative may seek legitimate credentials and use the access granted to an employee.
That approach can make detection more difficult because activity may initially resemble normal workplace behaviour.
The potential consequences depend on the access obtained. A compromised account with limited permissions presents a different risk from one that can reach proprietary source code, customer information or critical business systems.
The reported use of intermediaries and laptop farms adds another layer of complexity by separating the apparent employee’s location from the person actually performing the work.
For businesses, the lesson is that cybersecurity cannot begin and end with a firewall or antivirus software. Identity verification, recruitment checks, access management and continuous monitoring are also part of protecting corporate networks.
The FBI’s warning places renewed attention on these controls as companies continue to expand remote and international hiring.