North Korean Hackers Infiltrate Dozens of US Companies, DOJ Warns
TL;DR
- The U.S. Justice Department says North Korean IT operatives using stolen and fake identities have infiltrated dozens of U.S. companies as remote tech workers, funneling millions in salaries back to Pyongyang.
- Prosecutors allege Americans were recruited as facilitators to run laptop farms, verify identities, and launder payments, helping sanctioned workers evade detection and steal sensitive corporate data.
- Federal officials warn the scheme is ongoing and expanding, urging tech employers to strengthen identity verification for remote hires and report suspicious activity.
A Quiet Invasion of the Remote Workforce
What looks like a normal remote hiring process has become one of North Korea's most lucrative weapons for evading sanctions.
According to recent warnings from the U.S. Department of Justice, North Korean operatives dispatched by the regime have secured remote IT jobs at dozens of American companies — including tech firms, startups, and Fortune 500 contractors — using fake resumes, stolen identities, and AI-enhanced interview tactics.
Once hired, these workers collect regular salaries, often ranging from $70,000 to over $200,000 a year, and funnel the funds back to Pyongyang to support the North Korean government and its weapons programs. Officials estimate the broader IT-worker scheme has generated hundreds of millions of dollars for the regime over the past several years.
The DOJ says the operation is not opportunistic hacking, but a state-directed strategy run by sanctioned entities tied to North Korea's Ministry of Defense and intelligence services.
How the Scheme Works
Investigators describe a well-oiled pipeline. North Korean IT workers, often based in China, Russia, and other friendly jurisdictions, pose as U.S.-based freelance developers, app engineers, cybersecurity analysts, and blockchain specialists.
To pass background checks, they use U.S. Social Security numbers and identities stolen or purchased from real Americans. In some cases they create entirely synthetic personas with LinkedIn profiles, GitHub histories, and portfolio websites.
Video interviews are gamed with deepfake tools, voice changers, and stand-ins. Once hired, the operatives rarely show up on camera, citing poor connections or privacy concerns, and deliver work that is often outsourced further or generated with AI assistance to maintain cover.
Americans Recruited as Facilitators
A critical new focus of the DOJ's crackdown is the network of Americans allegedly helping the scheme succeed from inside the United States.
Prosecutors say North Korea is actively recruiting U.S. citizens and residents to act as facilitators — running so-called laptop farms, where company-issued laptops are kept at U.S. addresses to spoof corporate location checks. Facilitators also receive paychecks, open bank accounts and shell companies, verify employment eligibility, and forward the equipment and proceeds overseas.
In recent indictments and plea agreements, the Justice Department has charged several individuals with conspiracy to violate sanctions, wire fraud, identity theft, and money laundering for their roles. Some defendants allegedly managed dozens of laptops at a time and collected a cut of each salary.
Officials stress that some facilitators were witting co-conspirators, while others were unwitting freelancers hired on platforms like Upwork and LinkedIn to do administrative tasks without understanding who they were working for.
More Than Just a Paycheck: Data Theft and Extortion
The DOJ warns the threat goes far beyond lost wages. Once embedded inside corporate networks with legitimate credentials, North Korean IT workers gain privileged access to source code, customer data, cloud infrastructure, and internal tools.
In multiple cases, investigators say operatives stole proprietary data and then extorted their employers — threatening to leak sensitive code or company secrets unless a ransom was paid after they were fired or discovered.
Cybersecurity firms tracking the groups, often dubbed Famous Chollima, UNC5267, and part of the broader Lazarus ecosystem, report that compromised companies have included tech, media, fintech, crypto, defense-adjacent contractors, and AI startups.
Officials fear stolen data and persistent access could enable future espionage, supply-chain attacks, and cryptocurrency thefts to further fund the regime.
Why U.S. Companies Keep Falling For It
The explosion of remote-first hiring since the pandemic has created perfect conditions for the scheme. Tech talent shortages, fully asynchronous interviews, and reliance on third-party staffing firms make it difficult to verify who is really behind the keyboard.
Investigators say most victim companies had no idea they had hired North Korean nationals until contacted by the FBI. Red flags cited by the DOJ include reluctance to appear on video, inconsistencies in background details, use of VoIP numbers, requests to ship laptops to addresses different from listed residences, and logins from unexpected overseas IP addresses.
In some cases, a single North Korean operative was found to be working multiple full-time U.S. jobs simultaneously under different aliases.
DOJ Crackdown and Seizures
The Justice Department says it is responding with coordinated seizures, indictments, and sanctions in partnership with the FBI and Treasury Department.
Recent actions have included seizure of bank accounts holding illicit salaries, takedown of domains and infrastructure used by the IT workers, and sanctions designations against North Korean companies and intermediaries operating in China and Russia.
Federal prosecutors in Missouri, Massachusetts, New Jersey, and the District of Columbia have led several of the cases, with officials promising more charges to come. The State Department continues to offer multimillion-dollar rewards for information leading to disruption of the networks.
What Employers Should Do Now
Federal officials are urging all companies hiring remote IT staff — especially startups and crypto firms — to treat identity verification as a national security issue.
Recommended steps include mandatory live video onboarding with government ID verification, checking for inconsistencies in employment history, monitoring for use of remote-access tools and location spoofing, restricting shipment of corporate devices, and conducting re-verification for existing remote contractors.
The FBI has issued detailed public service announcements with lists of red flags and advises companies that suspect infiltration not to immediately confront the employee, but to contact their local FBI field office to preserve evidence and prevent data loss.
Get All The Latest Updates Delivered Straight To Your Inbox For Free!