Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes): Detecting and Preventing Fraudulent Remote Hires

North Korean state-directed IT workers obtain remote jobs at companies worldwide under stolen or borrowed identities, collect salaries that fund the regime, and in some cases steal code and data or extort their employers once discovered. US and UK authorities have issued repeated advisories since May 2022, and US prosecutors have described laptop farms that served hundreds of employers. Unlike a conventional intrusion, the attacker arrives through your own hiring process and receives legitimate credentials, so the threat sits between personnel security, endpoint security, identity and sanctions compliance. This guide covers how the schemes operate, the detection signals named by the FBI, Treasury, OFSI and incident responders, sanctions exposure, and how to contain and offboard a suspected worker, including revoking the tokens and keys they created. It is for security operations, insider risk, IAM, HR and compliance teams. Candidate verification controls are covered in depth in the Hiring Fraud and Candidate Identity Verification Guide; this page focuses on the scheme itself and on what happens after hire.

Key takeaways

• This is a state revenue scheme first. US and UN statements tie overseas DPRK worker income to weapons programmes; data theft, extortion and malware are added risks seen in some cases.
• Facilitators make it work. People in the victim's country receive laptops, host them in laptop farms, provide local internet, open bank accounts and sometimes attend interviews, so a local address and bank account prove little.
• The strongest signals are technical. Remote access tools installed soon after laptop delivery, IP-based KVM devices, commercial VPN egress, impossible travel and repository copying to personal accounts are more reliable than any interview impression.
• Paying a worker can be a sanctions breach. OFSI says civil penalties for breaching UK financial sanctions do not require proof of knowledge, and US guidance sets out civil and criminal exposure under OFAC regulations.
• Offboarding must cover non-human credentials. Disabling the account is not enough: rotate the API keys, tokens, SSH keys and secrets the worker created or could read, and check for persistence before telling them anything.

How DPRK IT worker schemes operate

The FBI, Mandiant and Microsoft describe a consistent operating model. Mandiant tracks the activity as UNC5267 and notes it is not a single centralised group; Microsoft tracks it as Jasper Sleet (formerly Storm-0287), alongside related clusters it names Storm-1877 and Moonstone Sleet. Mandiant reports that the workers are mostly based in China and Russia, with smaller numbers elsewhere.

Do not confuse this with the reverse pattern, in which fake recruiters target developers with malicious coding tests. MITRE ATT&CK tracks that activity as G1052 Contagious Interview, a North Korea aligned group focused on software developers and cryptocurrency. Both abuse the hiring relationship, but the defences differ. See the Lazarus Group Threat Actor Profile and the Threat Actor Groups Guide for the wider DPRK picture.

A note on framing: these schemes are run by a state and its facilitators, many of whom are nationals of other countries, including the employer's own. Mandiant found personas claiming education in Singapore, Japan and Hong Kong. Nationality, accent or a foreign degree is not a signal; reused contact details, location mismatches and technical artefacts are.

What the authorities and courts have found

• May 2022 joint guidance: the US Department of State, Treasury and FBI published red flags for freelance platforms and employers, including logins continuous for a day or more, remote desktop port configurations, payment requests in virtual currency or to PRC-based accounts, and requests to ship laptops to addresses not on the developer's identification.
• May 2024 FBI PSA (I-051624-PSA): focused on witting and unwitting US facilitators, and listed address changes after hiring but before laptop delivery and E-Verify errors as red flags.
• January 2025 FBI PSA (I-012325-PSA): warned that discovered workers hold stolen code and data hostage, have publicly released proprietary code, and copy repositories to personal GitHub and cloud accounts.
• Chapman case: on 24 July 2025 an Arizona facilitator was sentenced to 102 months in prison. The Justice Department said the scheme affected 309 US companies and two international businesses, used 68 stolen identities, and generated more than $17 million; agents seized more than 90 laptops from her home in October 2023.
• June 2025 nationwide action: the Justice Department announced searches of 21 premises in 14 states hosting known or suspected laptop farms, seizure of about 137 laptops, and charges alleging jobs at more than 100 US companies, about $900,000 in virtual currency stolen from two blockchain firms, and access to a defence contractor's controlled technical data. These are allegations in court documents.
• July 2025 OFAC designations: Treasury designated a DPRK-linked cyber actor associated with Andariel, a Russian national and four entities involved in placing and employing DPRK IT workers, noting some workers introduced malware into company networks.
• UK OFSI advisory (reference 0924): warns that UK firms employing or paying DPRK IT workers could be directly or indirectly breaching financial sanctions, and that two or more red flags warrant increased due diligence.

KnowBe4 published its own account in July 2024: a hire who passed four video interviews, a background check and references received a Mac workstation shipped to what the company later called a laptop farm. Its EDR flagged malware loading at 9:55 pm EST on 15 July and the SOC contained the device about 25 minutes later; KnowBe4 states no data was lost. The lesson is that endpoint telemetry caught what hiring checks did not.

Detection signals across the employment lifecycle

Mapped to ATT&CK v20, the relevant techniques are T1078 Valid Accounts (the worker's own legitimate access), T1219 Remote Access Tools, T1200 Hardware Additions (KVM devices), T1133 External Remote Services, T1567 Exfiltration Over Web Service and, for cryptocurrency theft, T1657 Financial Theft. Persona building maps to T1585 Establish Accounts and T1588.007 Artificial Intelligence.

Preventive controls on the endpoint and in identity

• Application allowlisting for remote access tools: block unapproved remote management software and hunt for installations, as Microsoft recommends. Approve one remote support tool, owned by IT, and alert on any other. See the RMM Tool Security Guide.
• No local admin by default: the FBI's January 2025 PSA recommends disabling local administrator accounts and limiting rights to install remote desktop applications.
• Device and location binding: record the laptop serial number at shipping and verify it at IT onboarding, and confirm the device's geolocation matches the stated residence, both Mandiant recommendations. Ship equipment only to the address on the worker's verified identification, as the 2022 guidance advises.
• Restrict KVM and peripherals: Mandiant advises restricting IP-based KVM devices. Device control policies and network access control that flag unknown network-attached devices on a home network will not see everything, but USB device inventory on the endpoint will.
• Phishing-resistant, hardware-bound MFA: Mandiant suggests hardware MFA to enforce physical possession. A security key shipped with the laptop and required for sign-in makes it harder to work from a different device in another country.
• Conditional access on network origin: block or flag sign-ins from known commercial VPN and hosting ranges for employee accounts, and alert on unexpected geolocations, as Microsoft suggests.
• Least privilege for new joiners: KnowBe4 recommends keeping new hires out of production at first. Grant production, signing and customer data access after a probation period and a second identity check.
• Repository controls: restrict forking and cloning of private repositories to managed devices, disable personal access to organisation repositories from unmanaged accounts, and log clones.

Sanctions and legal exposure

The financial risk is not limited to salary paid for little work. If the worker is a DPRK national acting for the regime, payments may breach sanctions.

Sanctions positions change. Check the current OFAC and OFSI guidance and take legal advice before deciding on payments to a suspected worker, including final salary.

Containment, offboarding and credential revocation

Microsoft advises keeping the response to a small, trusted group trained in operational security so the subject is not alerted, assessing the worker's access to critical assets, and treating containment or eviction as risk-based options. The FBI warns that discovered workers have extorted employers, so plan the revocation before any conversation.

1. Convene and preserve: bring together security, legal, HR and the manager. Preserve EDR telemetry, identity provider logs, source control audit logs and email before any account change. Report to IC3 (US) or OFSI and the NCA (UK) as legal advises.
2. Inventory everything the identity touched: human accounts, group memberships, cloud roles, and the non-human credentials the worker created or could read: personal access tokens, OAuth app grants, SSH keys, API keys, service account keys, CI/CD secrets, signing keys and shared vault entries.
3. Revoke in one window: disable the account, revoke all sessions and refresh tokens, remove MFA methods, then rotate every secret on the inventory. Rotation matters because a key known to the worker stays valid after their account is gone, as the Coupang signing key breach showed when a former engineer's retained token signing key was used months after departure.
4. Isolate and recover the device: network-isolate the laptop through EDR, and recover it through a trusted courier rather than asking the worker to return it. Microsoft advises resetting passwords for any account used to install remote management software and investigating further if a system-level account was used.
5. Hunt for persistence: review systems the worker accessed for added accounts, new OAuth apps, deploy keys, webhooks, scheduled jobs, remote management agents and code changes, including smart contract or pipeline modifications.
6. Check data exposure: review clones, downloads and personal cloud uploads to scope what may be used for extortion, and prepare for that scenario with legal.
7. Close the payroll loop: stop payments, record the bank details used, and check for the same details, phone numbers or addresses across other employees and contractors, since workers often hold several roles.

See the Employee Offboarding Security Guide and the NHI Offboarding and Decommissioning Guide.

Where identity fits

A fraudulent hire is an identity proofing failure that becomes a credential problem. Once provisioned, the worker creates non-human identities of their own: tokens for the code host, API keys for test environments, service accounts in CI pipelines. Those credentials do not belong to the joiner workflow and are rarely removed by it. Tie every token and key a person creates to their human identity record, so that offboarding the person lists, and revokes, what they made. See the Insider Threat and Identity Guide.

Decision guidance

• Contain quietly or confront: if there is evidence of data theft or malware, contain first (isolate, revoke, rotate) and talk later. If the evidence is only a weak signal, step up verification (an unscheduled on-camera check with identity document, which Mandiant recommends periodically) before acting.
• Agency and contractor staff: the FBI asks employers to audit staffing firms routinely. Where you cannot inspect the agency's checks, apply your own identity proofing and device controls to contractors as if they were employees.
• Small organisations: the cheapest effective controls are shipping only to the verified address, one approved remote support tool, a hardware security key per laptop and a short in-person meeting for developers.
• Large organisations: correlate HR, payroll, logistics and identity data. Duplicate bank accounts, phone numbers and shipping addresses across the workforce are the signals a single team never sees.

Measurement

• Percentage of remote hires whose laptop serial number and delivery address were verified against their proofed identity.
• Number of unapproved remote access tool installations detected, and median time to block.
• Percentage of employee sign-ins from commercial VPN or hosting ranges that were blocked or reviewed.
• Duplicate contact, bank or address matches found across employees and contractors per quarter.
• At offboarding, percentage of tokens, keys and secrets created by the leaver that were revoked or rotated within 24 hours.

Framework mapping

Common failure patterns

• Trusting the domestic address: a local delivery address and bank account are exactly what facilitators provide.
• Allowing any remote access tool: without allowlisting, AnyDesk or RustDesk on a new laptop looks like normal IT behaviour.
• Offboarding the account, not the credentials: tokens, deploy keys and secrets outlive the account, as the Coupang case shows.
• Tipping off the subject: a manager conversation before revocation gives the worker time to copy data and set up extortion.
• Siloed data: HR, payroll and logistics each see one oddity and none sees the pattern.
• Profiling by nationality: it is unlawful, unfair and misses facilitators and stolen local identities.

Practitioner checklist

• Ship laptops only to the address on verified identity evidence and record serial numbers for check at onboarding.
• Allowlist one remote support tool and alert on any other remote access or KVM software or hardware.
• Remove local admin rights from new joiner devices.
• Require a hardware security key issued with the laptop for all sign-ins.
• Block or review employee sign-ins from commercial VPN and hosting ranges and alert on impossible travel.
• Keep new hires out of production until a probation period and second identity check are complete.
• Correlate phone numbers, bank accounts and addresses across employees and contractors quarterly.
• Pay only into accounts in the worker's verified name and screen payees against sanctions lists.
• Maintain a quiet-response runbook: preserve evidence, revoke sessions, rotate every token and key the worker created, recover the device.
• Report suspected cases to IC3 (US) or OFSI and the NCA (UK) with legal advice.

Standards and references

• FBI IC3: North Korean IT Workers Conducting Data Extortion
• FBI IC3: Democratic People's Republic of Korea Leverages U.S.-Based Individuals to Defraud U.S. Businesses and Generate Revenue
• US Department of State, Treasury and FBI: Guidance on the Democratic People's Republic of Korea Information Technology Workers
• HM Treasury OFSI: Advisory on North Korean IT Workers
• US Department of Justice: Coordinated Nationwide Actions to Combat North Korean Remote IT Workers
• US Department of Justice: Arizona Woman Sentenced for $17M IT Worker Fraud Scheme
• Google Cloud (Mandiant): Mitigating the DPRK IT Worker Threat
• Microsoft Threat Intelligence: Jasper Sleet, North Korean remote IT workers' evolving tactics

Related NHI Mgmt Group resources: Hiring Fraud and Candidate Identity Verification Guide · Insider Threat Programme Guide · Lazarus Group Threat Actor Profile · RMM Tool Security Guide · Data Exfiltration Guide