Deepak Gupta

Workforce and access social engineering · Also called DPRK IT workers, North Korean remote IT worker scheme, laptop farm scheme, fake remote developer, remote IT worker fraud

North Korean fake IT workers

The North Korean fake IT worker scheme is a hiring fraud in which workers acting for North Korea use stolen or fake identities to get remote technology jobs at foreign companies. Their pay funds the North Korean government, and some also steal company data and code, then extort the employer when they are discovered.

How it works

Workers apply for remote IT jobs using stolen or fake identities, sometimes using AI and face-swapping tools in video interviews.
Facilitators in the target country receive company laptops at so-called laptop farms and connect them for remote access, for example through KVM switches or remote desktop software, or reship them abroad.
Facilitators also set up bank accounts, job site profiles, and front companies, while the salaries go to North Korea.
Some workers copy code and sensitive data and, once discovered, extort the company by threatening to release it.

Red flags

A new hire asks for the company laptop to be sent to an address different from the one on their ID, or changes address after hiring.
The candidate avoids clear video, cannot answer simple questions about where they live, or has AI-like glitches on camera.
The same phone number, email address, or resume content appears on other applicants' files, or profiles do not match the resume.
The employee changes bank accounts often, asks to be paid in cryptocurrency, or logs in from several countries in a short time.

If you are targeted

Stop: hold further equipment shipments, payments, and access for the suspected worker while you investigate.
Capture and review the network activity of the suspected employee and their devices, including remote connections and data copied to external accounts.
If the worker threatens to leak data, involve law enforcement before responding; the FBI warns that complying with extortion does not guarantee the data will not be shared.
Report it to the FBI at ic3.gov or your local FBI field office, or to your national cyber agency outside the US.

Where to report, by country

Prevention

For individuals

Never agree to receive and run company laptops for someone else, or to let anyone use your identity to get a job; US facilitators have been prosecuted.
If you suspect someone is working under your name, report it through IdentityTheft.gov or your national equivalent.
If you recruit for a company, verify candidates' previous employers and schools directly, not through contacts they supply.

For organisations

Verify identity during interviewing, onboarding, and throughout employment, and complete as much of the process in person as possible.
Cross-check HR records for reused phone numbers, emails, and resume content, and verify education and employment directly with the institutions.
Ship equipment only to the address on the employee's ID, and grant no system access until background checks are complete.
Monitor for prohibited remote desktop tools, logins from several countries, and data copied to personal repositories or cloud accounts, and hold staffing firms to the same standards.

Real cases

2025-07 · US · Sentenced · $17M impact
Christina Chapman's laptop farm for North Korean IT workers, 2025
2024-07 · US · Disclosed
KnowBe4 catches a North Korean fake IT worker it had hired, 2024

How official datasets classify it

MITRE ATT&CK: T1219

Questions

What do the FBI and the Justice Department say about North Korean IT workers?: The US government has issued advisories since 2022, and FBI public service announcements in 2024 and 2025 warn that North Korean IT workers pose as remote workers and that some steal data and extort employers. The Justice Department has prosecuted US-based facilitators who ran laptop farms and says the workers used stolen and fake identities of US persons.
How can we avoid hiring a North Korean IT worker?: The FBI recommends verifying identity throughout hiring and employment, checking for reused contact details, verifying employment and education directly, meeting in person where possible, and shipping laptops only to the address on the employee's ID.