North Korean IT workers are using Americans to infiltrate US companies, warns FBI

The Federal Bureau of Investigation (FBI) in an alert has warned that North Korean IT workers are expanding their efforts to secure jobs at Western companies by using American intermediaries, stolen identities and increasingly complex recruitment schemes. In an alert issued on Tuesday (Oct 13), the FBI’s Internet Crime Complaint Center said North Korean operatives were paying people in the US to help conceal their identities and locations while working remotely for American businesses. The agency said the money generated through these jobs helps fund the North Korean government, including its nuclear weapons and military programmes.

The latest warning describes a growing network of facilitators who help applicants get hired, attend interviews, verify identities and keep company-issued laptops connected to the internet from locations in the United States. Some are asked to lend their social media or professional networking accounts, receive work devices at home or complete identity checks on behalf of someone else.

"These actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny," it warned.

Americans facing financial pressure among targets

According to the FBI, North Korean IT workers are increasingly "strategically target(ing) those under financial stress," offering payment in exchange for help with employment-related tasks.

The agency said some use elaborate backstories, fake companies and forged documents to make their requests appear legitimate. In some cases, they claim to be Chinese or other East Asian nationals seeking a temporary presence in the US, or Eastern Europeans displaced by the Russia-Ukraine war.

The arrangements can extend well beyond recruitment. The FBI said facilitators are sometimes paid to host laptops in their homes, allowing North Korean workers to access the devices remotely while appearing to work from within the United States. These setups, commonly known as “laptop farms”, have been used for years, but operators are now spreading devices across more locations to reduce the risk of disruption.

The agency also reported that North Korean workers are subcontracting some assignments to freelancers, often in countries including India, Pakistan and Nigeria. Other freelancers are hired to submit job applications or attend interviews on their behalf.

FBI reports threats and attempts to extort companies

The warning describes a more troubling aspect of the operation: intimidation and extortion.

The FBI said it had observed North Korean IT workers threatening former managers and their families after being dismissed, demanding additional payments. Others allegedly threatened to leak sensitive company data, publish proprietary information or damage a business’s reputation unless they received large sums of money.

In some cases, US-based facilitators were allegedly sent to companies or the homes of people operating laptop farms to intimidate them.

The agency said stolen personal information remains central to the scheme. Operatives use identities belonging to other people to apply for jobs and may obtain access to sensitive personal data through their employment. The FBI also reported cases in which people whose identities had been stolen were contacted and threatened.

Companies urged to strengthen hiring checks

The FBI cautioned employers against relying on a single warning sign to identify fraudulent applicants. Instead, it recommended combining identity checks, access controls and monitoring throughout the recruitment and employment process.

Companies were also advised to bring together human resources, IT, security and management teams to identify suspicious patterns. The agency warned that overly broad screening could wrongly exclude legitimate applicants or harm people whose identities have been stolen.