Who is North Korea recruiting in the US to mask identities and bypass corporate security?
The FBI warns that state-sponsored remote workers are increasingly recruiting Americans to mask their identities and bypass corporate security controls.
Key points
- North Korean IT workers are using US citizens to handle interviews, identity verification and device hosting.
- The FBI advises companies to adopt an "identity in depth" approach with layered access controls.
- Facilitators are often targeted based on financial stress and offered payment for illicit support services.
The short version
- State-controlled remote workers are expanding their use of American intermediaries to hide from detection.
- These workers target individuals facing financial pressure to perform tasks like hosting laptops or verifying fake IDs.
- The FBI states that no single indicator can reliably identify these threats due to their evolving tactics.
The details
The FBI Internet Crime Complaint Centre reports that North Korean IT workers are refining methods to infiltrate Western firms while evading scrutiny. According to the advisory, these state-controlled remote employees increasingly rely on both willing and unaware Americans to obscure their true involvement. The agency highlights that this recruitment strategy is designed to counter improved private sector detection capabilities and ongoing law enforcement efforts.
These workers pay Americans for a wide range of services aimed at hiding their participation in the scheme. Requests include appearing on camera during job interviews, verifying fraudulent identities, and providing access to personal social or professional networking accounts. The FBI notes that some individuals are asked to ship packages, complete urinalysis tests, or keep employment-related devices connected to the internet from their personal residences.
The context
The agency warns that these operations fund the North Korean government, including its nuclear weapons and military programmes. The FBI describes these workers as a significant national security threat and a vector for intellectual property theft. They pose an insider risk by embedding themselves within corporate structures through deceptive means.
To lend credibility to their requests, IT workers often invent elaborate backstories. They may claim to be Chinese or East Asian nationals needing temporary US presence, or Eastern Europeans displaced by the Russia-Ukraine war. They create fake companies and produce official documentation to support these narratives. The FBI cautions that they have used threats of physical violence to compel Americans to continue these illicit activities.
Next steps
The FBI urges the public to reject any request for personal or financial information in exchange for payment. Individuals should be aware that fake job openings often appear on well-known boards as simple freelance gigs. If you receive threats to your life or feel concerned about physical safety, the agency advises calling 911 immediately. Participating in these schemes exposes individuals to law enforcement scrutiny and legal risk.
What defenders should look for
Security teams should monitor for unusual remote access patterns and identity verification anomalies. Look for discrepancies between interview locations and claimed residential addresses. Check for sudden changes in device management or unexpected software installations on employee endpoints. Investigate any requests for third-party identity verification or unusual shipping activities linked to new hires. Verify employment details through multiple independent channels rather than relying on provided documentation alone.
What to do and how to stay safe: North Korea
- Implement layered identity verification processes that extend beyond initial onboarding.
- Monitor remote desktop usage and network connections for deviations from standard employee behaviour.
- Train staff to recognise and report requests involving identity fraud or physical device hosting.
- Review hiring practices to identify potential facilitator involvement in the recruitment pipeline.
Step-by-step guide: Threat Intelligence Feeds: Mechanics, Noise and Practical Usage
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are North Korean IT workers using American facilitators?
They use Americans to counter improved detection methods and law enforcement actions while hiding their true involvement.
What services are Americans asked to provide?
Services include appearing on camera, verifying fraudulent identities, hosting devices, and completing biometric tests.
How should companies detect these threats?
The FBI recommends an "identity in depth" approach with multiple layered access controls and detections.
