Identity Fraud Scheme: North Korean IT Workers Infiltrate US Firms

Remote work infrastructure faces significant identity verification risks, as demonstrated by a Department of Justice announcement regarding North Korean IT worker schemes. The agency detailed coordinated actions against a network that infiltrated more than 70 US companies. This operation highlights how organisations relying on distributed teams remain exposed to sophisticated identity fraud and covert access points.

Root cause

The scheme relied on stolen or fabricated identity documents to secure remote positions. According to the indictment, workers used virtual private networks and proxy infrastructure to appear as US persons working domestically. This deception allowed them to bypass standard hiring checks. The operation generated more than $3 million in revenue, which prosecutors believe funded illicit activities, including weapons development for the regime.

Attack path

From 2019 to around July 2025, the group executed a multi-year fraud strategy. They recruited US nationals to operate laptop farms, keeping work devices at home to facilitate remote access from abroad. The FBI seized approximately 187 computer devices during searches of suspected farms in Texas. This method allowed foreign workers to maintain continuous access to corporate systems while masking their true geographic location.

Affected versions

The scheme targeted organisations across various sectors, including health, telecommunications, cyber support, retail and manufacturing. These firms operated across 17 states and Washington, DC. The indictment does not specify particular software versions or vulnerabilities exploited, but rather focuses on the human and procedural failures in remote hiring and identity verification processes that allowed the infiltration.

Mitigation

• Verify the physical location and identity of remote employees through rigorous onboarding checks.
• Monitor for unusual login patterns that suggest virtual private network usage from unexpected regions.
• Ensure that device management policies require strict control over hardware used for corporate access.

Signals worth monitoring

Teams usually notice discrepancies between claimed and actual employee locations. Check whether login metadata aligns with stated work addresses. Look for devices that remain active outside normal business hours or show connectivity from foreign networks. Verify that all remote workers have undergone recent identity re-validation. Containment moves typically involve isolating suspicious endpoints and reviewing access logs for unauthorised data transfers.

What to do and how to stay safe: North Korea

• Audit current remote employee onboarding procedures for identity verification gaps.
• Review network logs for connections originating from unexpected geographic regions.
• Confirm that all work devices are physically located within authorised jurisdictions.
• Once the vendor provides an update, implement stricter access controls for remote roles.

Step-by-step guide: Cyber Espionage Explained: How Silent Theft Works and How to Stop It

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many companies were affected by this scheme?

More than 70 US companies were affected by the North Korean remote IT worker conspiracy.

What charges are the defendants facing?

The 14 indicted individuals face charges of wire fraud, money laundering and identity theft.

Did the FBI seize any equipment?

Yes, the FBI seized approximately 187 computer devices from suspected laptop farms in Texas.